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ABSTRACT 


Whistleblowing  serves  as  a  eheek/balanee  system  to  the  government  bureaueraey, 
helping  to  bypass  administrative  roadbloeks  and  to  provide  a  meehanism  through  whieh 
homeland  seeurity  ean  monitor  and  inerease  effieieney  in  its  operations.  However, 
homeland  seeurity  also  deals  with  information  that  ean  be  of  a  sensitive  or  seeret  nature, 
the  unauthorized  diselosure  of  whieh  ean  eause  damage  to  both  homeland  seeurity  efforts 
and  national  seeurity.  The  eurrent  proeess  for  the  authorized  submission  of 
whistleblowing  information  fails  to  provide  whistleblowers  the  proteetions  they  require, 
instead  eneouraging  whistleblowers  to  diselose  information  to  the  media  or  through 
stateless  news  organizations  like  Wikileaks  to  prevent  reprisals. 

The  teehnologieal  eapability  to  provide  whistleblowers  proteetions  through 
anonymity  eurrently  exists,  and  has  been  demonstrated  to  be  effeetive.  By  leveraging 
those  teehnologies  and  setting  up  an  authorized  proeess  for  responsible  diselosure, 
through  whieh  homeland  seeurity  employees  ean  submit  whistleblowing  information 
without  fear  of  reprisals,  it  may  inerease  the  likelihood  of  whistleblowers  reporting  issues 
in  the  first  plaee,  and  reduee  the  number  of  leaks  to  unauthorized  reeipients 
(media/stateless  news  organizations). 
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EXECUTIVE  SUMMARY 


Introduction — A  dramatic  change  in  the  information-sharing  environment  has 
oeeurred  over  the  last  deeade.  New  teehnologies,  the  rapid  evolution  of  the  Internet,  and 
innovations  in  soeial  media  have  provided  the  ability  to  gather  and  share  information  at 
an  unprecedented  level.  The  Executive  Braneh  of  the  U.S.  Government  touts  the  virtues 
of  transparency,  while  Congress  defines  whistleblowing  and  the  diselosure  of 
government  fraud/waste/abuse  as  a  “eivie  duty”,  and  yet  the  Freedom  of  Information  Aet 
(FOIA)  proeess  is  broken,  the  Whistleblower  Proteetion  Aet  (WPA)  is  woefully 
inadequate,  and  seereey  eontinues  to  run  rampant.  The  diselosure  of  hundreds  of 
thousands  of  potentially  elassified  doeuments  to  the  organization  Wikileaks  may  be  an 
example  of  what  this  eontradiction  has  eaused.  The  existence  of  Wikileaks  as  an 
organization  is  irrelevant  now,  and  their  most  signifieant  eontribution  is  not  the  release  of 
1.2  million  doeuments.  Rather,  the  most  signifieant  impaet  of  Wikileaks  is  their 
suecessful  demonstration  and  validation  of  the  ‘Wikileaks  model.’  Wikileaks  has 
demonstrated  the  power  of  the  Internet  using  web  teehnologies  to  provide  proteetions 
through  anonymity,  while  giving  individuals  aeeess  to  a  worldwide  audienee.  The  eurrent 
troubles  faeed  by  the  organization  may  or  may  not  portend  the  end  of  Wikileaks; 
however,  it  does  provide  a  glimpse  into  the  future  of  whistleblowing.  Building  upon  the 
apparent  suecess  of  the  Wikileaks  model,  the  Wall  Street  Journal  and  Al-Jazeera  have 
both  implemented  “anonymous”  whistleblower  submission  sites.  This  new  paradigm  for 
eommunieations,  as  enabled  by  the  innovative  uses  of  the  Internet  and  soeial  media, 
provides  both  opportunities  and  areas  for  eoneern  regarding  government  transpareney. 

Problem  Statement — Whistleblowing  serves  as  a  eritieal  check  and  balance 
system  to  government  bureaueracy,  helping  to  eireumvent  administrative  roadbloeks  and 
to  provide  a  meehanism  through  which  homeland  seeurity  ean  monitor  and  inerease 
effieieney  in  its  operations.  Homeland  seeurity  also  deals  with  information  that  ean  be  of 
a  sensitive  or  seeret  nature,  the  unauthorized  diselosure  of  whieh  ean  eause  damage  to 
both  homeland  seeurity  efforts  and  national  seeurity.  Maintaining  the  balanee  between 
seereey  and  transpareney  is  a  diffieult  proposition;  however,  eurrent  government  efforts. 
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particularly  its  handling  of  whistleblowers,  plaees  that  balanee  in  jeopardy.  The 
government  has  taken  some  steps  to  address  some  of  these  problems;  however,  the 
government  has  also  taken  extreme  measures  to  proseeute  any  whistleblowers  who  stray 
outside  the  appropriate  submission  process  (i.e.,  deemed  an  unauthorized  leak  of 
sensitive/elassified  information)  or  are  not  proteeted  by  the  WPA.  Instead  of 
aeknowledging  that  eurrent  poliey  on  whistleblowers  is  broken,  the  government’s  eurrent 
eourse  of  aetion  deereases  the  likelihood  important  fraud/waste/abuse  information  will  be 
reeeived  from  whistleblowers,  while  possibly  influeneing  their  deeision  and  eneouraging 
them  to  bypass  authorized  ehannels  and  instead  utilize  the  Internet  to  proteet  themselves 
from  identifieation  and  retaliation.  The  current  laek  of  publie  trust  in  government,  and  the 
existence  of  alternative  avenues  for  disclosure  that  provide  greater  proteetions  than  those 
eurrently  offered  by  the  U.S.  Government,  serve  to  exaeerbate  the  problem. 

Research  Question — What  poliey  model  and  assoeiated  technologieal  proeess 
eould  the  U.S.  DHS  implement  that  will  eneourage  whistleblowers  to  submit  information 
through  authorized  ehannels  as  opposed  to  leaking  information  to  unauthorized  parties? 

Analysis — To  answer  the  researeh  question,  this  thesis  explores  three  primary 
areas.  The  first  is  the  whistleblowing  environment,  to  inelude  definitions,  applieable 
policies,  laws  (both  domestie  and  international),  authorized  and  unauthorized  processes, 
motivations,  public  trust,  requirements,  and  intentions  of  all  parties  involved.  The  seeond 
area  of  focus  is  technology,  specifically,  the  available  options,  best  praetices,  and 
vulnerabilities  of  potential  teehnologieal  solutions  (e.g.,  phone,  email,  web).  The  final 
portion  of  thesis  serves  to  develop  and  evaluate  policy  options  based  on  the  findings  and 
eonelusions  identified  in  the  first  two  areas  of  analysis.  Those  findings  are  as  follows. 

•  Overolassifieation  is  a  problem 

•  Information  sharing  is  eritieal  to  both  U.S.  seeurity  and  U.S  demoeraey 

•  Homeland  seeurity  efforts  require  publie  (to  inelude  its  employees  and 

partners)  trust  and  support  to  succeed 

•  The  ability  to  keep  seerets  and  maintain  eontrol  of  elassified  information 
will  continue  to  deerease 

•  Deereasing  overolassifieation  will  save  the  United  States  money 

•  Whistleblowing  is  a  oivic  duty 


•  The  government  is  committed  to  providing  whistleblower  protections 

•  Whistleblowers  are  in  large  part  motivated  by  patriotism 

•  Anonymity  is  a  positive  incentive  for  whistleblowers 

•  Fourth  and  Fifth  Estates  (media  and  stateless  news  organizations)  provide 
alternatives  to  the  government  process 

•  Public  trust  in  the  government  has  declined 

•  Public  trust  can  be  increased  through  the  use  of  third  parties 

•  Technology  exists  to  provide  anonymity  to  whistleblowers 

•  Current  options  for  whistleblowing  are  inadequate 

These  premises  form  the  foundation  and  justification  for  the  implementation  of 
any  solution. 

Current  legitimate/authorized  processes,  such  as  submission  through  standard 
government  channels,  present  significant  risks  to  the  whistleblower. 
Clandestine/unauthorized  processes,  such  as  the  Internet  (Wikileaks)  and  mainstream 
media,  represent  a  clear  breach  of  the  law,  which  is  in  conflict  with  the  “do  the  right 
thing”  mindset  of  many  whistleblowers.  If  whistleblowers  had  a  way  to  communicate 
identified  issues  through  an  authorized  third  party  that  would  serve  as  a  proxy  on  their 
behalf,  it  would  undermine  the  current  processes  (both  legitimate  and  clandestine), 
potentially  making  them  obsolete.  It  would  reduce  the  personal  risk  faced  by 
whistleblowers  by  providing  the  anonymity  that  makes  the  clandestine  approach 
attractive,  without  clearly  breaking  the  law.  The  Department  of  Homeland  Security  has 
an  opportunity  to  build  upon  and  improve  the  “Wikileaks  Model,”  to  harness  its  use  of 
technology  and  process  to  create  a  solution  that  would  meet  the  needs  of  both 
whistleblowers  and  the  government.  If  implemented  correctly,  the  number  of  legitimate 
whistleblower  complaints  would  increase  (overall  submissions  would  increase),  and  the 
number  of  whistleblowers  who  choose  unauthorized  avenues  would  be  expected  to 
decrease. 

Recommendation — For  any  solution  to  be  considered  successful,  it  is  critical  to 
establish  a  clear  definition  of  success.  This  thesis  proposes  the  following  definition  of 
success  for  any  whistleblowing  solution. 
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To  promote  the  voluntary  diselosure  of  information  by  any  man  or  woman 
who  reasonably  believes  that  organizational  wrongdoing  has  occurred,  the 
facilitation  of  corrective  action  to  address  the  wrongdoing,  and  providing 
for  the  protection  of  the  submitter  while  maintaining  information  security, 
all  within  the  bounds  of  U.S.  law. 

Four  key  pillars  create  the  foundation  for  success. 

•  Whistleblowers  must  have  the  support  of  leadership 

•  Legislation  and  policies  must  be  clear  and  straightforward 

•  Whistleblowing  policies  must  enforce  accountability 

•  Authorized  channels  must  provide  at  least  as  much  protection  as 
unauthorized  channels 

The  conclusions  drawn  in  this  thesis,  including  the  policy  model  ultimately 
recommended,  is  based  on  the  research  and  the  findings  identified  above.  Combined  with 
a  current  understanding  of  the  problem,  the  evaluation  criteria,  and  the  potential  solutions 
available,  it  is  recommended  that  the  government  establish  a  partnership  with  a  non¬ 
government  organization  (NGO)  within  U.S.  legal  jurisdiction,  and  subsidize  the 
establishment  of  a  government  sponsored  whistleblower  submission  website  and  virtual 
private  network.  This  solution  would  allow  whistleblowers  to  submit  information  to  the 
government  with  the  protection  of  anonymity,  through  the  third  party  NGO.  Establishing 
this  policy  provides  whistleblowers  who  truly  believe  in  improving  government 
operations  through  the  submission  of  information  on  fraud/waste/abuse  or  other  types  of 
concerns,  a  legitimate  way  to  achieve  their  goal  without  risking  their  career  and  future  on 
the  weak  whistleblower  protections  currently  in  place.  While  it  may  not  completely 
eliminate  leaks  to  the  media  or  organizations,  such  as  Wikileaks,  the  researcher  believes 
those  leaks  will  decrease  as  more  whistleblowers  give  the  government  an  opportunity  to 
act  on  their  submission. 


xviii 


ACKNOWLEDGMENTS 


This  thesis  would  not  have  been  possible  without  the  contribution  and  support  of 
many  people.  I  cannot  possibly  express  the  full  extent  of  my  gratitude  and  appreciation, 
but  I  wish  to  acknowledge  those  who  made  it  possible  for  me  to  complete  this 
tremendous  undertaking. 

To  my  parents:  Thank  you  very  much  for  constantly  pushing  me  to  pursue 
additional  opportunities  for  education  and  intellectual  growth.  Thank  you  also  for  the 
hours  you  spent  reading  and  commenting  on  this  thesis. 

To  my  sister:  Thank  you  for  opening  your  world  of  educational  resources  and 
research  expertise  to  me.  Your  support  and  encouragement  helped  to  keep  me  motivated 
throughout  this  process. 

To  my  friends  and  colleagues:  Thank  you  for  your  understanding  and  support  of 
the  task  I  had  to  complete.  Thank  you  also  for  reminding  me  that  mental  and  physical 
breaks  are  necessary. 

To  the  U.S.  Department  of  Homeland  Security:  Thank  you  for  supporting  my 
participation  in  this  program.  Having  the  opportunity  to  engage  in  some  of  the  most 
productive  and  educational  dialogues  and  interactions  through  the  Center  for  Homeland 
Defense  and  Security  has  granted  me  powerful  perspectives  on  the  issues  facing  our 
nation. 

To  the  Naval  Postgraduate  School’s  Center  for  Homeland  Defense  and  Security: 
Thank  you  for  the  opportunity  to  participate  in  cohorts  1005/1006.  I  know  I  was  the 
Vincent  Gambini  of  grad  school  applicants,  but  the  opportunity  afforded  me  through  this 
program  has  truly  been  life  changing.  My  only  hope  is  that  I  was  able  to  contribute  as 
much  as  I  received. 

To  the  professors  and  staff  of  CHDS:  Thank  you  for  challenging  me,  pushing  me 
to  overcome  any  obstacles,  and  for  motivating  me  to  explore  possibilities  I  had  not 
considered.  This  thesis  reflects  input  from  every  one  of  you,  and  without  you,  it  would 
not  have  been  possible. 


XIX 


To  my  beautiful  fiance:  Thank  you  for  supporting  me  during  the  last  18  months: 
for  tolerating  my  books  and  papers  all  over  the  house,  bearing  with  my  rants  on 
seemingly  random  topics,  for  being  flexible  and  understanding  when  I  waited  until  the 
last  minute  to  finish  an  assignment,  and  most  of  all,  for  just  being  yourself,  my 
inspiration. 


XX 


I.  INTRODUCTION 


In  February  of  1777,  just  months  after  our  founding  fathers  signed  the  Deelaration 
of  Independenee,  10  sailors  who  had  joined  the  U.S.  Navy  to  fight  for  independenee  from 
Great  Britain,  met  on  board  the  warship  Warren.  They  met,  not  to  plan  a  battle  against 
the  King’s  armies,  but  rather  to  vet  their  eoneerns  about  the  ineompetenee  and  laek  of 
moral  integrity  of  the  eommander  in  ehief  of  the  Continental  Navy,  Commodore  Esek 
Hopkins.  These  sailors  were  devoted  to  fighting  and  winning  the  War  for  Independenee. 
They  were  revolutionaries,  risking  their  lives  to  build  a  free  and  independent  Ameriea; 
they  wanted  nothing  more  than  to  fight  and  defeat  their  British  foes.  However,  they 
feared  that  their  eommander  eould  not  suoeessfully  lead  them.  They  blew  the  whistle  on 
his  mistreatment  of  prisoners,  petitioning  the  Continental  Congress  and  stating  Hopkins 
had  “treated  prisoners  in  the  most  inhuman  and  barbarous  manner.”  Congress  aeted  on 
the  information  they  reeeived  and  removed  Hopkins  from  office.  Unfortunately,  the 
incident  did  not  end  there.  Hopkins  had  not  only  held  the  top  Navy  job,  but  also  came 
from  a  powerful  colonial  family;  his  brother  was  governor  of  Rhode  Island  and  one  of  the 
original  signers  of  the  Declaration  of  Independence.  Hopkins  sought  revenge  against  the 
whistleblowers — retaliating  against  them  both  during  his  short  remaining  tenure  as 
commander  and  after  he  was  stripped  of  his  command.  On  July  30,  1778,  the  Continental 
Congress  came  to  the  whistleblowers  defense  (Kohn,  2011). 

Subsequently,  the  Continental  Congress,  without  any  recorded  dissent,  passed  a 
resolution  that  encouraged  all  citizens  to  blow  the  whistle  on  official  misconduct.  It  read: 

That  it  is  the  duty  of  all  persons  in  the  service  of  the  United  States,  as  well 
as  all  other  inhabitants  thereof,  to  give  the  earliest  information  to  Congress 
or  any  other  proper  authority  of  any  misconduct,  frauds  or  misdemeanors 
committed  by  any  officers  or  persons  in  the  services  of  these  states,  which 
may  come  to  their  knowledge.  (Continental  Congress,  1778) 
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Whistleblowers  have  played  a  key  role  in  government  affairs  since  the  founding 
fathers,  facing  significant  personal  risks  of  reprisals  and  retaliation  to  perform  their 
patriotic  duty  to  ensure  the  nation’s  safety  and  security.  In  the  236  years  since  then,  and 
despite  the  best  efforts  of  Congress,  those  risks  remain. 

A.  PROBLEM  STATEMENT 

A  dramatic  change  in  the  information-sharing  environment  has  occurred  over  the 
last  decade.  New  technologies,  the  rapid  evolution  of  the  Internet,  and  innovations  in 
social  media  have  provided  the  ability  to  gather  and  share  information  at  an 
unprecedented  level.  The  government’s  failure  to  adapt  to  the  new  environment  and 
adequately  address  its  over-classification  problem  (Hall,  2005),  combined  with  a  decline 
in  investigative  journalism  and  traditional  news  media’s  increasing  inability  to  serve  as  a 
government  watchdog,  has  created  a  public  backlash,  which  is  a  particularly  important 
issue  for  the  Department  of  Homeland  Security  (DHS).  The  homeland  security  enterprise 
is  comprised  of  “Federal,  State,  local  tribal,  territorial,  nongovernmental,  and  private- 
sector  entities,  as  well  as  individuals,  families,  and  communities  who  share  a  common 
national  interest  in  the  safety  and  security  of  America  and  the  American  population” 
(U.S.  Department  of  Homeland  Security,  2010).  From  suspicious  activity  reporting  and 
contributing  to  the  deterrence  of  terrorist  activities,  to  leveraging  public  preparedness  to 
empower  communities,  help  minimize  fear,  and  diminish  the  effectiveness  of  terrorist 
tactics,  the  public  plays  a  key  role  in  homeland  security  efforts  (U.S.  Department  of 
Homeland  Security,  2010).  The  Final  Report  of  the  National  Commission  on  Terrorist 
Attacks  Upon  the  United  States  (National  Commision  On  Terrorist  Attacks  Upon  The 
United  States,  2004)  found  that  existing  trends  of  over-classification  and  secrecy 
deprived  intelligence  and  law  enforcement  of  a  potent  weapon  against  terrorism:  an  alert 
and  well-informed  American  public  (National  Commision  On  Terrorist  Attacks  Upon 
The  United  States,  2004).  Over-classification  and  the  accompanying  lack  of  transparency 
have  eroded  public  trust  in  the  government,  resulting  in  a  decrease  in  security  as  well. 
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The  Executive  Branch  of  the  U.S.  Government  touts  the  virtues  of  transparency, 
while  Congress  defines  whistleblowing  and  the  disclosure  of  government 
fraud/waste/abuse  as  a  “civic  duty”  (Committee  on  Government  Reform,  House  of 
Representatives,  2006),  and  yet  the  Freedom  of  Information  Act  (FOIA)  process  is 
broken  (U.S.  Office  of  Special  Counsel,  2004),  the  Whistleblower  Protection  Act  (WPA) 
is  woefully  inadequate  (Mihm,  2001),  and  secrecy  continues  to  run  rampant  (Aftergood, 
2010a).  The  disclosure  of  hundreds  of  thousands  of  potentially  classified  documents  to 
the  organization  Wikileaks  may  be  an  example  of  what  this  contradiction  has  caused. 
While  the  majority  of  the  U.S.  Government  and  much  of  the  news  media  had 
immediately  condemned  the  website,  describing  the  disclosure  as  treasonous  and  calling 
for  the  termination  of  the  site  itself  and  prosecution  of  its  founder,  Julian  Assange;  the 
fact  remains  that  the  situation  has  changed.  The  existence  of  Wikileaks  as  an  organization 
is  irrelevant  now,  and  their  most  significant  contribution  is  not  the  release  of  1 .2  million 
potentially  classified  documents.  Rather,  the  most  significant  impact  of  Wikileaks  is  their 
successful  demonstration  and  validation  of  the  ‘Wikileaks  model.’  Wikileaks  has 
demonstrated  the  power  of  the  internet  using  web  technologies  to  provide  protections 
through  anonymity,  while  giving  individuals  access  to  a  worldwide  audience.  The  current 
troubles  faced  by  the  organization  may  or  may  not  portend  the  end  of  Wikileaks  as  an 
organization;  however,  it  does  provide  a  glimpse  into  the  future  of  whistleblowing. 
Building  upon  the  apparent  success  of  the  Wikileaks  model,  the  Wall  Street  Journal  and 
Al-Jazeera  have  both  implemented  “anonymous”  whistleblower  submission  sites.  This 
new  paradigm  for  communications,  as  enabled  by  the  innovative  uses  of  the  Internet  and 
social  media,  provides  both  opportunities  and  areas  for  concern  regarding  government 
transparency.  It  is  time  for  a  significant  change  in  thinking  regarding  how  the  U.S. 
Government  handles  government  whistleblowers. 

Whistleblowing  serves  as  a  critical  check  and  balance  system  to  government 

bureaucracy,  helping  to  circumvent  administrative  roadblocks  and  to  provide  a 

mechanism  through  which  homeland  security  can  monitor  and  increase  efficiency  in  its 

operations.  Two  former  federal  agents  have  even  made  the  case  that  9/1 1  could  have  been 

prevented  if  whistleblowers  had  been  able  to  bypass  the  key  officials  who  ignored  the 
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warnings  and  prevented  the  sharing  of  key  intelligence  (Rowley,  2010).  Even  the  9/11 
Commission  concluded  that  had  the  information  about  Moussaouui’s  arrest  been  made 
public,  the  9/11  plot  may  have  been  postponed  (National  Commision  On  Terrorist 
Attacks  Upon  The  United  States,  2004). 

Homeland  security  deals  with  information  that  can  be  of  a  sensitive  or  secret 
nature,  the  unauthorized  disclosure  of  which  can  cause  damage  to  both  homeland  security 
efforts  and  national  security.  Maintaining  the  balance  between  secrecy  and  transparency 
is  a  difficult  proposition;  however,  current  government  efforts,  particularly  its  handling  of 
whistleblowers,  places  that  balance  in  jeopardy.  The  government  has  taken  steps  to 
address  some  of  these  problems  by  releasing  new  executive  orders  (E.O.)  on  classified 
information  (Office  of  the  White  House  Press  Secretary,  2009),  and  new  policies 
addressing  some  of  the  issues  associated  with  EOIA  (O’Keefe,  2009).  The  government 
has  also  taken  extreme  measures  to  prosecute  any  whistleblowers  who  stray  outside  the 
appropriate  submission  process  (i.e.,  deemed  an  unauthorized  leak  of  sensitive/classified 
information)  or  are  not  protected  by  the  WPA  (Goodman,  2007)).  The  government’s 
position  on  whistleblowers  is  further  confused  by  the  recent  anonymous  hold  placed  on 
the  passage  of  the  Whistleblower  Protection  Enhancement  Act  (a  measure  designed  to  fix 
the  issues  with  the  WPA)  in  Congress,  despite  its  bi-partisan  support  (S.  Devine,  2010). 
Instead  of  acknowledging  that  current  policy  on  whistleblowers  is  broken,  the 
government’s  current  course  of  action  decreases  the  likelihood  important 
fraud/waste/abuse  information  will  be  received  from  whistleblowers,  while  possibly 
influencing  their  decision  and  encouraging  them  to  bypass  authorized  channels  and 
instead  utilize  the  Internet  to  protect  themselves  from  identification  and  retaliation. 

Despite  widespread  agreement  that  whistleblowers  play  an  important  role  in 
government,  current  U.S.  policies  governing  whistleblowers  and  their  legal  rights  are 
widely  accepted  as  inadequate,  incomplete,  and  confusing.  No  fewer  than  fifteen  separate 
laws  provide  some  guidance  on  the  authorized  conduct  for  and  the  protection  of 
whistleblowers.  Worse  still,  even  fewer  protections  exist  for  employees  of  “national 
security”  agencies  and  the  intelligence  community  (IC)  which,  remarkably,  are  not 
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currently  covered  by  the  most  significant  legislation  to  date,  the  Whistleblower  Proteetion 
Aet.  Despite  repeated  attempts  by  Congress  to  revise  legislation  and  inerease  support  of 
whistleblowers,  the  increase  in  unauthorized  diselosures  eontinues.  The  eurrent  laek  of 
publie  trust  in  government,  and  the  existenee  of  alternative  avenues  for  diselosure  that 
provide  greater  proteetions  than  those  eurrently  offered  by  the  U.S.  Government,  serve  to 
exaeerbate  the  problem. 

B.  RESEARCH  QUESTION 

What  poliey  model  and  assoeiated  teehnologieal  process  eould  the  U.S.  DHS 
implement  that  will  encourage  whistleblowers  to  submit  information  through  authorized 
ehannels  as  opposed  to  leaking  information  to  unauthorized  parties? 

C.  SIGNIFICANCE  OF  RESEARCH 

This  researeh  is  designed  to  identify  a  near-term  implementable  solution  for  the 
federal  members  of  the  homeland  seeurity  enterprise  to  facilitate  and  inerease  authorized 
whistleblowing  by  providing  whistleblower  proteetions  while  simultaneously  proteeting 
sensitive  information.  While  the  primary  consumer  of  this  information  will  be  the  U.S. 
DHS  and  its  partners,  this  solution  will  have  broader  applieability  for  other  federal 
government  entities,  and  state  and  loeal  organizations  as  well.  The  poliey,  partieularly  its 
teehnologieal  components,  may  have  applieations  beyond  whistleblowers  as  it  could 
potentially  be  useful  as  an  anonymous  tip  line  for  the  publie,  eneouraging  participation  in 
the  national  “See  Something/Say  Something”  eampaign.  As  is  common  with  Web  2.0, 
the  true  value  of  technology  only  becomes  apparent  through  its  innovative  applieation 
and  use. 

D.  METHOD 

To  answer  the  researeh  question,  the  researeher  will  employ  a  hybrid 
methodology  including  both  conceptual  modeling  and  policy  analysis.  This  process 
consists  of  three  primary  steps. 
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The  development  of  a  coneeptual  model,  whieh  identifies  and  disseets  the  pieces, 
parts,  and  components  of  the  whistleblowing  environment  to  include  applicable  policies, 
laws,  motivations,  requirements,  and  intentions  of  all  parties  involved.  This  step  will 
allow  identification  of  these  elements  and  determine  findings  and  conclusions  associated 
with  each  element. 

The  conduct  of  a  technology  evaluation,  which  defines  the  vulnerabilities  of 
potential  technological  solutions.  Clearly  defining  the  vulnerabilities  of  information 
sharing  systems  (e.g.,  phone,  email,  web)  will  allow  the  best  suited  technology 
component(s)  for  the  recommended  policy  to  be  identified. 

The  development  of  a  recommended  course  of  action  (policy  model)  through  a 
policy  analysis  based  on  the  findings  and  conclusions  identified  by  the  conceptual  model 
and  the  vulnerabilities  identified  through  the  technology  evaluation.  The  policies  will 
then  be  assessed  against  identified  evaluation  criteria. 

E.  HYPOTHESES  OR  TENTATIVE  SOLUTIONS 

Whistleblowing  serves  as  a  check/balance  system  to  the  government  bureaucracy, 
helping  to  bypass  administrative  roadblocks  and  to  provide  a  mechanism  through  which 
homeland  security  can  monitor  and  increase  efficiency  in  its  operations.  However, 
homeland  security  also  deals  with  information  that  can  be  of  a  sensitive  or  secret  nature, 
the  unauthorized  disclosure  of  which  can  cause  damage  to  both  homeland  security  efforts 
and  national  security.  The  current  process  for  the  authorized  submission  of 
whistleblowing  information  is  broken,  with  current  whistleblower  policies  providing 
protections  only  after  reprisals  or  retaliation  have  occurred.  The  technological  capability 
to  provide  whistleblowers  protections  through  anonymity  currently  exists,  and  has  been 
demonstrated  to  be  effective.  The  concept  of  ‘Responsible  Disclosure’  in  the  information 
security  world  is  an  excellent  example  of  how  critical  vulnerability  disclosures  can  be, 
and  could  serve  as  a  model  for  a  potential  solution.  By  leveraging  those  technologies  and 
creating  an  authorized  process  through  which  homeland  security  employees  can  submit 
whistleblowing  information  without  fear  of  reprisals,  it  may  increase  the  likelihood  of 
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whistleblowers  reporting  issues  in  the  first  plaee,  and  reduee  the  number  of  leaks  to 
unauthorized  reeipients  (media/stateless  news  organizations).  While  teehnologieal  and 
poliey  solutions  exist  that  ean  be  applied  to  this  problem  by  the  government,  the  reality  is 
any  government  solution  is  likely  to  be  ineffeetive  without  addressing  the  issue  of  trust  in 
some  way. 
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II.  BACKGROUND 


A.  LITERATURE  REVIEW 

This  literature  review  examines  the  body  of  knowledge  on  how  the  U.S. 
Government  might  leverage  Internet  teehnologies  in  balaneing  seereey  and  transparency. 
The  literature  cites  studies  and  previous  works  going  back  as  far  as  the  1960s;  yet  much 
has  happened  over  the  last  decade  to  shape  the  debate  about  secrecy/transparency  in 
government  affairs  radically.  Between  the  relatively  recent  adoption  of  the  Internet  into 
mainstream  life  and  the  renewed  security  concerns  associated  with  the  ‘War  on 
Terrorism,’  the  relevant  literature  identified  in  this  thesis  was  primarily  published  after 
2001.  The  sources  have  been  derived  from  academic  journals,  mainstream  media,  non¬ 
governmental  organizations  (NGOs),  and  government  reports,  and  are  divided  into  three 
categories. 

•  E-Government  Initiatives 

•  Internet  Anonymity 

•  Government  Secrecy  and  Whistleblowers 

The  approach  each  individual  researcher  takes  varies  greatly;  however,  their 
arguments  are  for  the  most  part,  mutually  confirmatory.  The  one  area  with  the  largest 
disparity  of  conclusions  is  in  the  area  of  internet  anonymity,  while  the  conclusions  on  E- 
Government  initiatives  and  government  secrecy  and  whistleblowers  are  largely  uniform. 
A  few  areas  lack  research  and  study,  and  those  areas  are  identified  as  follows.  It  is 
significant  to  note  that  in  a  comparison  of  the  recommendations  identified  in  government 
reports,  academic  journals,  andNGO  reports,  little  discernible  disagreement  occurs. 

1,  E-Government  Initiatives 

E-Government  has  been  defined  as  “the  delivery  of  [government]  information  and 

services  online  via  the  Internet  or  other  digitals  means... and  may  include  opportunities 

for  online  political  participation”  (Tolbert,  2006).  The  literature,  which  evaluates  E- 

Government  initiatives,  has  generally  concluded  the  following:  our  nation’s  efforts, 

particularly  homeland  security,  are  dependent  upon  public  trust  and  participation;  E- 
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Government  initiatives  are  designed  to  improve  publie  eonfidenee  in  government,  and 
Web  2.0  has  demonstrated  particular  use  for  government  to  both  provide  and  receive 
information  from  the  public. 

While  few  agreed  upon  definitions  of  public  trust  exist,  it  is  generally  accepted 
across  the  literature  that  public  trust  and  confidence  play  a  key  role  in  U.S.  activities,  and 
that  it  has  declined  significantly  during  the  past  decade  (Welch,  2003;  Moon,  2003; 
Tolbert,  2006;  Banisar,  2007).  Government  reports  have  consistently  recommended 
increased  public  engagement.  The  U.S.  DHS  in  particular  has  increased  its  effort  to 
include  the  public  in  the  homeland  security  enterprise,  specifically  identifying  the  actions 
the  public  can  take  in  the  department’s  Quadrennial  Homeland  Security  Report.  “From 
suspicious  activity  reporting  and  contributing  to  the  deterrence  of  terrorist  activities,  to 
leveraging  public  preparedness  to  empower  communities,  help  minimize  fear,  and 
diminish  the  effectiveness  of  terrorist  tactics,  the  public  plays  a  key  role  in  homeland 
security  efforts”  (U.S.  Department  of  Homeland  Security,  2010). 

The  majority  of  the  literature  on  E-Government  initiatives  describes  their 
potential  benefits  in  terms  of  positive  gain  in  public  confidence.  By  exploring  case 
studies,  scholars  have  evaluated  the  public  response  to  E-Govemment  initiatives,  cost 
savings,  and  long  term  potential  of  these  efforts  to  improve  government  efficiency  and 
response  time  (West,  2004).  Overall,  agreement  exists  that  E-Government  initiatives 
show  promise  in  providing  significant  benefits  in  each  of  those  categories.  Some 
concerns  have  arisen  that  efficiency  gains  with  E-Government  will  beget  a  decline  in 
quality,  creating  a  “screen  bureaucracy”  that  will  actually  increase  distance  between  the 
public  and  the  government.  Also  discussed  is  the  point  that  while  E-Government  does 
provide  marked  improvements,  it  is  not  a  catchall  solution  (Parent,  2005).  However,  it  is 
generally  accepted  that  the  positives  outweigh  the  negatives. 

A  particularly  hot  topic  of  late  in  terms  of  E-Government  is  the  use  of  social 
media  or  Web  2.0  technologies  to  support  both  singular  and  two-way  communication.  A 
2008  study  found  that  despite  the  lessons  learned  from  Hurricane  Katrina  and  the 
increasing  use  of  social  media  by  emergency  management  organizations  an  overall  lack 
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of  understanding  by  leadership  still  existed  as  to  the  significant  role  that  social  media 
plays  in  communications  (Guth,  2008).  Since  2009,  at  least  three  theses  on  Web  2.0  and 
its  use  in  government  were  written  at  the  Naval  Postgraduate  School  alone.  These  theses 
argue  that  social  media  provides  an  avenue  for  increased  speed  and  efficiency  in 
communications  (Polania,  2010),  improved  information  sharing  (Bennington,  2010),  and 
an  increased  ability  to  inform  the  leadership’s  decision-making  process  (Van  Leuven, 
2009). 


2,  Internet  Anonymity 

The  literature  on  E-Government  has  not  specifically  explored  the  issue  of 
anonymity.  Significant  research  has  been  conducted  on  the  topics  of  anonymity,  privacy, 
and  the  security  of  information  on  the  Internet,  beginning  with  well-known  cryptography 
expert  David  Chaum’s  1981  paper  entitled  “Untraceable  Electronic  Mail,  Return 
Addresses,  and  Digital  Pseudonyms.”  Anonymity  is  often  discussed  as  a  founding 
principle  of  the  Internet,  an  explicit  right,  and  the  cornerstone  of  Internet  freedom 
(Diamond,  2010).  Three  distinct  positions  on  Internet  anonymity  have  been  identified  and 
defined  by  Ya-Ching  Eee  of  the  Institute  of  Communications  Management  at  National 
Sun  Yat-Sen  University  in  Taiwan,  as  the  Eibertarian  Model,  the  Private  Enterprise 
Model,  and  the  Statis  Model.  Simply  put,  the  Eibertarian  model  favors  anonymity  for 
individuals,  the  Private  Enterprise  model  looks  at  limiting  anonymity  so  companies  can 
gather  profiles  on  their  customer  base,  and  the  Statis  model  reflects  government’s  desire 
to  limit  anonymity  due  to  security  concerns  (Eee,  2006).  Eor  the  purposes  of  this  review, 
the  Private  Enterprise  model  was  not  considered  as  the  concerns  of  private  industry  are 
not  critical  in  the  security  vs.  transparency  debate. 

The  pro-Eibertarian  model  literature  states  that  anonymity  provides  individuals 
freedom  of  expression  and  protection  from  government/corporate  surveillance. 
Specifically,  the  Internet  has  provided  an  opportunity  for  people  to  fight  back  against 
oppressive  regimes  and  experience  freedom  without  the  fear  of  retaliation  (Diamond, 
2010).  Eibertarians  argue  that  the  Internet  is  self-regulating,  and  applying  Statis  model 
regulations  punish  citizens  and  criminals  equally  (Akdeniz,  2002).  Opponents  of  the 
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Libertarian  model  and  supporters  of  the  Statis  model  (not  neeessarily  the  same  thing) 
argue  that  anonymity  removes  accountability,  provides  an  opportunity  for  terrorists  and 
criminals  to  act  without  consequence,  and  provides  an  open  forum  for  racism  and  hatred 
(Davenport,  2002;  Morrison,  2005).  This  conflict  has  equal  support  on  both  sides,  and 
mirrors  the  issues  associated  with  the  balance  of  secrecy  and  transparency.  David  Sify, 
the  founder  of  Technorati,  illustrates  the  issue  “Taking  away  anonymity  would  have  a 
chilling  effect  on  the  Web.  We’d  lose  important  release  valves  like  whistle-blowing... 
[although]  accountability  brings  civility”  (Barret,  2007). 

While  this  debate  remains  primarily  at  a  stalemate,  a  couple  of  authors  propose 
pseudonymity  as  a  middle  ground.  Instead  of  having  an  unlimited  number  of  identities 
(associated  with  anonymity),  they  suggest  having  a  limited  number  of  alternate  identities 
with  which  individuals  can  surf  the  web  with  possible,  but  limited,  traceability  associated 
with  their  pseudonyms  (Zarsky,  2004).  Ultimately,  whether  anonymity,  pseudonymity,  or 
strict  identification  is  the  answer,  more  research  needs  to  be  done.  Specifically,  for  the 
purposes  of  E-Govemment,  identifying  how  to  validate  information  received  through 
social  media  is  another  area,  which  lacks  exploratory  research  and  solutions. 

3.  Government  Secrecy  and  Whistleblowers 

A  significant  amount  of  literature  discusses  whistleblowers  and  their  role  in  the 
government  secrecy/transparency  debate.  The  discussion  has  been  reinvigorated  by 
“cablegate,”  the  release  of  hundreds  of  thousands  of  classified  Department  of  State  cables 
to  the  website  Wikileaks  (Rosenweig,  2010).  While  the  debate  over  the  role  of  media  and 
the  Internet  in  whistleblowing  activities  is  very  active,  widespread  agreement  exists 
among  scholars  and  the  government  regarding  the  problem  of  over-classification  and  the 
role  of  whistleblowers  in  providing  transparency  in  government  affairs. 

The  U.S.  Government  has  repeatedly  and  openly  acknowledged  the  problem  of 
over-classification.  In  a  statement  to  the  U.S.  House  of  Representative’s  Committee  on 
Government  Reform,  Director  of  the  Information  Security  Oversight  Office  J.  William 
Leonard  stated,  “it  is  no  secret  that  the  [U.S.]  Government  classifies  too  much 
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information  (T.  Devine,  2011).”  At  his  eonfirmation  hearing,  Director  of  National 
Intelligence  James  R.  Clapper  stated,  “We  do  over-classify.  We  can  be  a  lot  more  liberal, 
1  think,  about  declassifying,  and  we  should  be  (Aftergood,  2010a).”  Even  President 
Barack  Obama  publicly  acknowledged,  “effective  measures  to  address  the  problem  of 
over-classification”  (Aftergood,  2010a)  are  needed.  Over-classification  leads  to  a 
degradation  in  U.S.  ability  to  engage  in  homeland  security  efforts  effectively  by  reducing 
the  flow  of  critical  information  across  agencies  and  levels  of  government  (National 
Commision  On  Terrorist  Attacks  Upon  The  United  States,  2004). 

Speculation  has  arisen  as  to  the  costs  and  consequences  associated  with  over¬ 
classification;  however,  there  have  not  been  many  definitive  answers  identified  through 
studies.  Some  authors  argue  that  excessive  government  secrecy  and  over-classification 
has  reduced  government  accountability  by  obstructing  the  public’s  ability  to  seek 
disclosure  of  government-held  information  (The  Constitution  Project’s  Liberty  and 
Security  Committee,  2009).  The  Final  Report  of  the  National  Commission  on  Terrorist 
Attacks  Upon  the  United  States  (9/11  Commission  Report)  found  that  existing  trends  of 
over-classification  and  secrecy  deprived  intelligence  and  law  enforcement  of  a  potent 
weapon  against  terrorism;  an  alert  and  well-informed  American  public  (National 
Commision  On  Terrorist  Attacks  Upon  The  United  States,  2004).  In  FY2009,  alone,  the 
costs  associated  with  government  security  classification  were  approximately  $8.8  billion 
dollars,  not  including  intelligence  agencies’  expenditures  (Kosar,  2010).  More  research 
needs  to  be  done  to  demonstrate  the  real  costs  and  benefits,  both  financial  and  social,  of 
addressing  the  over-classification  problem.  Still,  current  policy  and  legal  solutions  to  the 
over-classification  problem  are  limited  and  unimaginative  for  providing  for  a  significant 
role  for  whistleblowers  to  play. 

Clay  Shirky,  an  author  and  expert  on  Internet  technologies  and  their  social  impact, 

writes. 

For  many  of  our  most  important  social  systems,  we  resolve  clashing 
principles  by  providing  an  escape  valve,  in  the  form  of  a  set  of  actors  who 
are  less  rule-bound  than  the  rest  of  the  system.  The  most  famous  and 
ancient  is  the  jury,  a  collection  of  amateurs  who  can,  in  the  face  of  clear 
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laws  and  evidence,  simply  not  return  the  verdict  a  judge  would  have 
returned.  So  with  secrecy.  Though  I  am  not  a  lawyer,  the  Supreme  Court’s 
1971  ruling  seems  to  say  that  there  is  no  law-like  way  to  balance  the 
State’s  need  for  secrets  with  the  threats  secrets  pose  to  democracies. 

(Shirky,  2010) 

In  the  context  described  above,  Shirky  is  not  alone  in  the  idea  of  whistleblowers 
as  the  “non-law  like  way”  to  address  secrecy;  in  fact,  both  the  academic  and  government 
communities  support  the  actions  of  whistleblowers  as  necessary  to  report  fraud,  waste 
and  abuse  in  government  (Verschoor,  2010;  Vandekerckhove,  2010;  Smith,  2010;  Fisher, 
2005).  Congress  has  gone  as  far  to  say,  “All  Federal  employees  are  ethically  bound  to 
expose  violations  of  law,  corruption,  waste,  and  substantial  danger  to  public  health  or 
safety”  (Committee  on  Government  Reform,  House  of  Representatives,  2006). 

In  addition  to  the  widespread  agreement  of  the  importance  of  whistleblowers, 
general  acknowledgement  also  exists  that  whistleblowers  face  significant  risks  of 
retaliation  and  reprisal  (Goodman,  2007;  Project  on  Government  Oversight,  2005;  S. 
Devine,  2010),  and  that  current  whistleblower  protections  are  inadequate  (U.S.  Office  of 
Special  Counsel,  2004;  Mihm,  2001;  U.S.  Merit  Systems  Protection  Board,  2010; 
Committee  on  Government  Reform,  House  of  Representatives,  2006).  Many  authors  have 
provided  policy  recommendations  to  address  retaliation;  however,  most  of  the 
recommendations  are  focused  on  managing  the  consequences  after  retaliation  occurs. 
Very  little  research  discusses  the  possibility  of  addressing  the  problem  from  a  prevention 
standpoint.  Two  current  government  efforts  are  happening  to  leverage  technology  and 
anonymity  to  promote  whistleblower  activities,  the  Government  Accountability  Office 
(GAO)’s  FRAUDNET  (Government  Accountability  Office,  2009)  and  the  Department  of 
Defense’s  ‘Defense  Hotline’  (Department  of  Defense  Inspector  General,  2007).  An 
opportunity  exists  to  study  the  lessons  learned  from  these  two  government  programs,  and 
examine  the  possibility  of  addressing  the  issues  of  whistleblower  retaliation  and  reprisal 
through  the  application  of  some  anonymity  technologies. 
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The  topics  of  E-Government,  Internet  anonymity,  and  whistleblowers  have  each 
individually  been  broadly  covered  by  the  current  field  of  research.  However,  a  detailed 
evaluation  or  discussion  of  the  interrelationships  between  these  concepts  has  not 
occurred.  For  example,  how  to  verify  the  accuracy  of  the  information  being  provided  by 
the  public,  if  the  submission  is  anonymous?  This  thesis  explores  those  relationships  for 
the  purposes  of  identifying  realistic  solutions  in  an  attempt  to  answer  what  may  be  an 
unanswerable  question — How  to  balance  secrecy  and  transparency? 

This  debate  has  been  ongoing  at  the  center  of  American  politics  back  to  the  days 
of  this  country’s  birth.  As  this  republic  was  being  established,  the  founding  fathers  were 
contemplating  the  questions  regarding  the  role  of  secrecy  in  government  affairs,  and  the 
extent  to  which  political  decisions  and  government  actions  should  be  transparent  to  the 
public.  Much  has  changed  over  the  last  200  years,  and  those  changes  have  seen  the  U.S. 
Government’s  policies  on  secrecy  and  transparency  shift  between  one  end  of  the 
spectrum  to  the  other.  The  shift  is  often  the  result  of  changes  to  the  political,  economic, 
and  technological  landscapes  impacting  this  country,  but  a  definitive  answer  to  the 
underlying  questions  has  yet  to  appear.  How  to  decide  what  the  public  needs  to  know, 
and  what  to  keep  confidential?  How  to  balance  government  accountability  with  national 
security  interests?  In  the  absence  of  agreement  among  government  leaders  and  sufficient 
government  mechanisms  to  ensure  transparency  to  the  public,  traditional  media 
organizations  have  long  played  a  role  as  an  external  “watchdog”  for  government 
activities.  The  idea  that  traditional  media  organizations  today  are  the  same  “free  press” 
described  by  Jefferson  is  no  longer  accurate.  The  government’s  ability  to  influence  and 
direct  the  media  has  increased  substantially  over  the  past  few  decades,  and  with  economic 
trouble  affecting  traditional  media  organizations’  ability  to  pursue  investigative 
journalism,  transparency  has  continued  to  decline,  which  is  surprising  considering  the 
dramatic  change  in  the  information-sharing  environment  over  the  last  decade.  New 
technology,  the  rapid  evolution  of  the  Internet,  and  innovations  in  social  media  have 
provided  the  ability  to  gather  and  share  information  at  an  unprecedented  level,  and  yet  the 
amount  of  classified  information  in  the  government  has  continued  to  grow  (Hall,  2005). 
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The  government’s  failure  to  adapt  to  the  new  environment  and  adequately  address 
the  over-elassification  problem,  as  well  as  the  traditional  media’s  inability  to  serve  as  the 
government  watchdog  adequately,  has  created  a  public  backlash.  The  recent  disclosure  of 
thousands  of  potentially  classified  documents  by  the  website  Wikileaks  is  an  example  of 
what  is  likely  to  be  a  growing  trend.  While  the  U.S.  Government  and  much  of  the  news 
media  have  immediately  condemned  the  website,  describing  the  disclosure  as  treasonous 
and  calling  for  the  termination  of  the  site  itself,  a  dissenting  viewpoint  does  exist.  Some 
argue  that  in  the  absence  of  sufficient  and  reasonable  government  efforts  to  provide 
transparency,  and  with  a  reduced  ability  of  the  news  media  to  perform  the  ‘watchdog’ 
function,  Wikileaks  provides  a  service  that  bypasses  the  bureaucracy  and  provides  vital 
information  to  the  public.  That  instead  of  treason,  Wikileaks  is  a  ‘whistleblower’  website 
and  it  should  be  considered  a  positive  tool  in  the  pursuit  of  government  transparency  and 
accountability.  Each  of  these  positions  represents  the  polar  ends  of  the 
secrecy/transparency  spectrum,  extreme  approaches  that  do  not  acknowledge  the  need  for 
a  balanced  answer.  To  identify  solutions  that  achieve  that  balance,  it  is  critical  to 
understand  the  principle  elements  at  play,  first  and  foremost:  whistleblowing. 

B,  PERCEPTION  OF  WHISTLEBLOWING 

Through  a  review  of  the  considerable  amount  of  research  that  has  been  focused  on 
government  whistleblowers,  it  is  clear  that  the  majority  of  employees  who  witness  acts  of 
wrongdoing  choose  not  to  report  it.  Despite  the  inaction  of  the  overwhelming  majority, 
there  are  those  who  do  step  forward  and  act,  regardless  of  the  potential  consequences 
they  face.  What  constitutes  a  whistleblower,  what  are  the  characteristics  that  set  these 
individuals  apart,  and  what  psychological  factors  influence  their  decisions?  This  section 
will  define  whistleblowers,  explore  both  the  dispositional  and  situational  factors  that 
affect  them,  and  ultimately,  propose  some  key  issues  that  must  be  addressed  to  support 
increased  whistleblowing  among  homeland  security  employees. 

Historically,  significant  support  for  whistleblowers  has  occurred  within  Congress 
and  the  public.  Popular  culture  has  seen  the  success  of  films,  such  as  Serpico  (1973),  The 
Insider  (1999),  and  The  Whistleblower  (2010),  which  honor  whistleblowers  as 
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courageous  champions  of  truth,  standing  alone  in  an  environment  of  rampant  corruption. 
Congress  has  also  traditionally  been  pro-whistleblower,  repeatedly  passing  and  revising 
laws  in  an  attempt  to  proteet  and  even  eneourage  whistleblowers  to  eome  forward.  In  her 
2003  book.  Whistleblowing:  When  it  Works-  and  Why,  Roberta  Ann  Johnson  even  goes 
as  far  to  elaim,  “It  is  no  surprise  that  regardless  of  party  or  ideology.  Congress  always 
passes  whistleblower  proteetive  legislation  unanimously”  (Johnson,  2003). 
Unfortunately,  that  no  longer  holds  true,  definitely  for  Congress  and  possibly  for  the 
public  at  large.  This  ehange  does  not  reflect  increased  support  for  corruption  and 
wrongdoing,  rather  it  stems  from  uncertainty  surrounding  the  definition  of 
whistleblowers  and  their  aetions.  As  stated  previously,  no  generally  aeeepted  definition 
for  whistleblowing  exists;  as  such,  it  has  come  to  mean  different  things  to  different 
people  (Miethe,  1999).  Signifieant  eultural  pressures  have  always  existed  not  to  break 
rank,  with  terms,  sueh  as  ‘sniteh’  and  ‘rat,’  prominently  used  to  deseribe  people  who 
speak  out  against  their  organization/group.  Even  among  kids,  ‘tattle -tale’  is  used  to  label 
those  who  inform  authority  figures  (teaehers/parents)  of  misdeeds  or  wrongdoing. 
Current  opponents  of  whistleblowers  even  go  as  far  as  using  terms,  such  as  ‘traitors’  to 
label  them  and  their  aetions,  seeking  to  invoke  serious  eharges  against  them,  including 
but  not  limited,  to  espionage  and  damaging  national  seeurity.  The  environment  ereated  by 
these  faetors  has  allowed  the  definition  of  whistleblowing  to  be  usurped  and  applied  (by 
both  extreme  seereey  advocates  and  extreme  transpareney  advoeates)  to  people  whose 
aetions  are  not  whistleblowing,  but  to  those  who,  in  fact,  may  have  jeopardized  national 
seeurity.  The  release  of  hundreds  of  thousands  of  diplomatic  cables  and  documents  from 
both  the  Iraq  and  Afghanistan  wars  to  ‘Wikileaks’  is  an  example  of  such  a  disclosure. 
The  indiseriminant  release  of  these  doeuments,  with  no  clear  objective,  to  an  organization 
that  exercises  the  ability  to  shape  the  messages  (alter  the  truth),  is  not  whistleblowing. 
Debates  have  occurred  as  to  the  aetual  damage  to  national  seeurity  caused  by  those 
releases;  however,  the  presenee  of  information  that  serves  the  ‘publie  interest’  is  also 
unclear.  Classifying  this  aetion  as  whistleblowing,  whieh  has  been  promoted  by  both 
sides  of  the  transparency/secrecy  debate,  only  serves  to  destabilize  support  for  legitimate 
eases  of  whistleblowers,  both  in  Congress  and  in  the  eyes  of  the  publie.  The  impaet  of  the 
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Wikileaks  disclosures  on  the  pereeption  of  whistleblowers  in  Congress  is  exemplified  by 
its  inability  to  pass  the  Whistleblower  Protection  Enhancement  Act  (WPEA),  specifically 
the  anonymous  hold  placed  on  the  bill  in  2010  (Devine,  2011). 

Two  ways  exist  to  address  the  perception  issue:  redefining  whistleblowing,  or 
replacing  the  terms  whistleblower  and  whistleblowing  with  alternatives  that  do  not  carry 
historical  baggage/controversy.  This  thesis  focuses  on  the  former — redefining 
whistleblowing  and  clarifying  the  key  components  of  the  definition.  Alternatives  to  the 
term  whistleblower  exist,  including  “lamp-lighter,”  which  if  propagated,  could  help  to 
address  the  negative  connotations  associated  with  whistleblowing,  and  should  be 
considered  for  future  use. 

I  have  always  preferred  the  term  “lamp  lighter”  to  whistleblower.  We  ean 
holler  and  shout  but  it’s  the  lamplight  that  shines  on  corruption,  injustice, 
ineptitude  and  abuse  of  power.  We  reveal  villains  as  they  try  to  scurry  into 
the  woodwork  in  hiding.  We’re  often  told:  ‘don’t  make  so  much  noise’  but 
we  can  reply,  ‘you’ll  soon  hear  noise  enough  before  long’. 

-  Frank  Serpico  (Projeet  on  Government  Oversight,  2002) 

C.  DEFINING  WHISTLEBLOWING 

While  no  single  definition  exists,  a  few  definitions  are  eommonly  used  to  describe 
whistleblowing.  Ralph  Nader,  in  1972,  used  one  of  the  earliest  definitions,  and  states, 
“whistleblowing  is  an  act  of  a  man  or  woman  who,  believing  that  the  public  interest 
overrides  the  interest  of  the  organization  he  serves,  blows  the  whistle  that  the 
organization  is  in  corrupt,  illegal,  fraudulent,  or  harmful  activity”  (Whistleblowing  CEE 
Project,  n.d.).  Marcia  P.  Miceli  and  Janet  P.  Near,  in  1982,  proposed  the  most  commonly 
referenced  definition  out  of  the  academic  field  of  whistleblowing  research,  which  states 
whistleblowing,  is  “the  disclosure  by  organization  members  (former  or  eurrent)  of  illegal, 
immoral,  or  illegitimate  practiees  under  the  control  of  their  employers,  to  persons  or 
organizations  that  may  be  able  to  effect  action”  (Miceli,  Near,  &  Dworkin,  2008). 
Finally,  the  U.S.  Government  defines  a  whistleblower  as  someone  who  “discloses 
information  he  or  she  reasonably  believes:  a  violation  of  any  law,  rule,  or  regulation; 
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gross  mismanagement;  a  gross  waste  of  funds;  an  abuse  of  authority;  a  substantial  and 
speeific  danger  to  public  health;  and/or  a  substantial  and  specific  danger  to  public  safety” 
(U.S.  Office  of  Special  Councel,  2010).  While  these  three  definitions  have  similarities, 
they  each  possess  a  distinct  and  yet  critical  element  required  for  a  complete  definition  of 
whistleblowing. 

The  role  of  whistleblowing  in  government,  specifically  its  legitimacy  and  process, 
are  often  debated  in  terms  of  the  whistleblower’s  motivations,  the  content/significance  of 
the  whistleblower’s  claims,  and  to  whom  the  report  is  made.  Not  every  act  involving  the 
disclosure  of  information  should  be  considered  whistleblowing  (Whistleblowing  CEE 
Project,  n.d.);  a  clear  definition  of  whistleblowing  is  required  to  delineate  whistleblowing 
from  other  activities.  Eor  example,  informants  “are  often  involved  in  some  sort  of 
unethical  affairs,  and  use  disclosure  for  clarifying  their  own  role,  or  reducing  their 
liability”  (Whistleblowing  CEE  Project,  n.d.).  This  definition  of  informant  could  be 
further  expanded  to  include  anyone  whose  motivation  for  disclosure  is  self-serving  in 
nature  (profit,  notoriety,  etc.).  To  distinguish  whistleblowers  from  other  categories  of 
behavior  (e.g.,  informants,  issue  selling,  taking  charge,  and  inactive  observers  (Miceli, 
Near,  &  Dworkin,  2008),  any  definition  of  whistleblowing  should  include  the  three 
distinct  key  elements  from  the  definitions  above:  “reasonably  believes,”  “public  interest,” 
and  “effect  action.”  It  is  important  to  highlight  that  it  may  not  be  possible  to  determine 
the  true  motivations  of  employees  who  expose  wrongdoing.  Similar  to  the  philosophical 
debate  on  the  existence  of  altruism,  it  is  impossible  to  prove.  In  all  likelihood, 
whistleblowers’  intent  probably  includes  a  mix  of  selfish  and  selfless  motivations 
(Johnson,  2003).  However,  by  including  the  phrase  “acting  in  the  public  interest,”  much 
needed  emphasis  on  the  selfless  part  of  intent  is  provided.  Eurther,  to  prevent  a  debate 
over  the  significance/size  of  wrongdoing,  which  may  impact  the  protections  afforded  the 
employee  filing  the  claim,  the  definition  of  whistleblowing  should  not  include  subjective 
terms,  such  as  “gross,”  “substantial,”  or  “specific.”  The  extent  of  the  wrongdoing  can  be 
determined  after  the  submission  is  made,  and  the  purpose  of  the  definition  should  be  to 
encourage  employees  to  come  forward.  A  more  complete  definition  of  whistleblowing 
might  look  like  the  following. 
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The  voluntary  disclosure  by  any  man  or  woman  acting  in  the  public 
interest  who  reasonably  believes  that  a  violation  of  any  law,  rule,  or 
regulation;  mismanagement;  a  waste  of  funds;  an  abuse  of  authority;  a 
danger  to  public  health;  and/or  a  danger  to  public  safety  has  occurred  and 
reports  that  information  to  persons  or  organizations  that  may  be  able  to 
effect  action. 

For  the  purposes  of  supporting  the  process  presented  in  this  thesis,  it  is  important 
to  expound  on  the  “persons  or  organizations  that  may  be  able  to  effect  action”  section  of 
the  definition. 

In  the  computer  security  world,  two  types  of  vulnerability  disclosures  exist,  full 
disclosure  and  responsible  disclosure.  Full  disclosure  can  be  defined  as  the  disclosure  of 
system  vulnerabilities  to  the  public  with  the  intent  of  using  public  exposure  to  prompt 
rapid  modification/adaptation  to  secure  the  vulnerability.  Responsible  disclosure  can  be 
defined  as  the  disclosure  of  system  vulnerabilities  to  the  responsible  party  for  a 
predetermined  amount  of  time,  to  allow  for  modification/adaptation  to  secure  the 
vulnerability  prior  to  full  disclosure.  For  a  responsible  disclosure  policy  to  be  successful, 
the  possibility  of  full  disclosure  must  exist.  Organizations  are  more  likely  to  take  prompt 
action  to  address  security  vulnerabilities  if  they  risk  being  exploited  or  losing  face  to  the 
public,  which  is  also  applicable  to  government  organizations  and  private  sector  critical 
infrastructure  organizations  as  well. 

D,  PSYCHOLOGICAL  FACTORS 

Throughout  history,  it  has  been  the  inaction  of  those  who  could  have 
acted;  the  indifference  of  those  who  should  have  known  better;  the  silence 
of  the  voice  of  justice  when  it  mattered  most;  that  has  made  it  possible  for 
evil  to  triumph 

-  Haile  Selassie,  former  emperor  of  Ethiopia.  (Zimbardo,  2007) 

Utilizing  the  proposed  definition  to  define  whistleblowing,  and  excluding  those 
who  report  misdeed  primarily  (or  solely)  for  personal  gain,  what  drives  whistleblowers  to 
act?  Significant  research  has  occurred  into  the  dispositional  characteristics  of 
whistleblowers  in  an  attempt  to  determine  if  particular  types  of  people  exist  who  are  more 

likely  to  be  whistleblowers  than  others.  It  is  easy  to  draw  some  assumptions  regarding 
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this  question,  including  the  oft  promoted  “whistleblowers  are  principled  individuals  with 
strong  moral  convictions  and  ethical  employees,  which  has  been  prominent  in  the 
academic  community”  (Miethe,  1999).  Many  dispositional  factors  could  potentially  affect 
whistleblowers,  including  educational  level,  age,  work  experience,  gender,  marital  status, 
and  religious  beliefs.  Based  on  these  factors,  additional  assumptions  have  been  made  that 
suggest  that  whistleblowers  are  more  likely  to  be  men  who  are  better  educated,  have 
strong  belief  systems  (religious),  are  more  likely  than  others  to  endorse  universal 
standards,  believe  in  making  sacrifices  for  the  greater  good,  feel  that  people  have  a 
responsibility  to  prevent  harm  to  others,  and  think  they  are  persons  of  worth  (Miethe, 
1999).  Regarding  age  and  work  experience,  a  number  of  conflicting  assumptions  have 
been  drawn,  with  no  clear  and  logical  conclusion  identified.  Despite  these  assumptions, 
research  conducted  by  Miethe  on  the  dispositional  traits  of  whistleblowers,  to  include 
personality  and  socio-demographic  factors,  indicates  the  lack  of  a  strong  difference 
between  whistleblowers  and  other  employees  (Miethe,  1999).  This  research  supports  the 
idea  that  no  specific  whistleblower  personality  really  exists,  and  instead,  whistleblowers 
are  more  likely  to  act  based  on  situational  factors. 

In  The  Lucifer  Effect,  Dr.  Philip  Zimbardo  explores  the  power  of  situational 
factors,  largely  in  the  context  of  his  Stanford  Prison  Experiment.  In  his  chapter  on  social 
dynamics,  Zimbardo  explores  the  factors  that  impact  situational  power,  and  the  studies 
that  have  demonstrated  it.  Concluding  his  chapter,  Zimbardo  cites  a  meta-analysis  of  over 
100  years  of  social  psychological  research,  including  25,000  studies  and  8  million  people, 
which  demonstrates  the  robust  and  reliable  impact  of  social  situational  forces  (Zimbardo, 
2007).  Many  of  these  situational  forces  affect  a  person’s  decision  as  to  whether  to  come 
forward  as  a  whistleblower,  and  understanding  those  forces  provide  a  greater  opportunity 
to  create  an  environment  more  conducive  to  whistleblowing. 

It  is  impossible  to  discuss  whistleblowing  without  addressing  consequences.  The 
U.S.  Merit  Systems  Protection  Board  (MSPB)  identifies  the  effect  whistleblowing  will 
have  on  an  individual’s  job,  career  and  future  as  one  of  the  most  significant  reasons  why 
people  do  not  become  whistleblowers  (Johnson,  2003).  Sissela  Bok,  an  ethicist,  argues 
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that  the  consequences  of  whistleblowing  must  be  carefully  weighed  prior  to  acting,  as 
they  can  cause  severe  damage  to  programs,  agencies,  and  the  people  involved  (Johnson, 
2003).  In  her  1981  essay,  “Blowing  the  Whistle,”  Bok  proposes  a  whistleblower  checklist 
designed  to  facilitate  the  evaluation  of  three  primary  issues  by  the  whistleblower — 
dissent,  loyalty,  and  accusation.  While  the  checklist  is  a  good  start  to  the  discussion,  it  is 
clearly  presented  in  terms  of  potential  consequences  to  the  organization.  It  does  not 
acknowledge  or  account  for  the  significant  risks  faced  by  the  whistleblowers  themselves. 
In  “Whistleblowing  At  Work,”  Miethe  posits  that  “about  half  of  all  whistleblowers  are 
expected  to  experience  severe  retaliation  by  management  for  their  disclosures”  (Miethe, 
1999).  Based  on  the  realities  faced  by  whistleblowers,  specifically,  the  likely 
consequences  they  face  (retaliation  by  harassment,  reassignment,  poor  performance 
reviews,  loss  of  clearances,  and/or  loss  of  the  job),  a  risk  category  should  be  added  to 
Bok’s  whistleblower  checklist.  The  checklist  proposed  in  The  Art  of  Anonymous  Activism 
focuses  almost  entirely  on  the  whistleblower,  and  could  serve  to  provide  balance  to  Bok’s 
whistleblower  checklist. 

Whistleblowing  is  often  debated  in  terms  of  loyalty,  specifically,  weighing  loyalty 
to  the  organization  against  loyalty  to  the  public  interest/moral  principles.  The  conflict 
between  these  two  forces  is  often  at  the  center  of  the  internal  debate  of  employees 
deciding  whether  or  not  to  come  forward.  Bok  describes  this  dichotomy  as  “loyalty  to  the 
agency  and  to  colleagues  comes  to  be  pitted  against  loyalty  to  the  public  interesf’ 
(Johnson,  2003).  In  1980,  Congress  passed  a  Code  of  Ethics  for  Government  Service, 
which  required  persons  in  government  service  to  “put  loyalty  to  the  highest  moral 
principles  above  loyalty  to  persons,  party,  or  government  departmenf’  (U.S.  Government, 
1980).  However,  the  reality  is  that  this  is  not  a  black  and  white  issue,  with  many  factors 
weighing  into  the  debate.  The  type  and  severity  of  misconduct  observed,  the  frequency  of 
the  misconduct,  and  the  relationship  between  the  potential  whistleblower  and  the  violator 
all  serve  to  influence  the  decision  to  come  forward.  For  some,  loyalties  to  groups  trump 
loyalties  to  moral  principles.  Following  his  acceptance  of  the  Nobel  Prize,  Albert  Camus 
stated,  “I  believe  injustice,  but  I  will  defend  my  mother  before  justice”  (Cusak,  2011). 
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For  others,  the  loyalty  to  principle  and  their  commitment  to  preventing  harm  outweighed 
all  of  the  other  factors.  C.  Fred  Alford  calls  this  the  whistleblower’s  “choiceless  choice” 
(Uys,  2011). 

Two  primary  types  of  situational  influences  affect  whistleblowers,  group 
influence  and  the  influence  of  authority.  Zimbardo  discusses  both  in  The  Lucifer  Effect, 
describing  group  influence  as  “often  indirect,  simply  modeling  the  normative  behavior 
the  group  wants  us  to  imitate  and  practice,”  while  authority  influence  is  “more  often 
direct  and  without  subtlety”  (Zimbardo,  2007).  Both  can  be  seen  as  having  significant 
influence  over  whistleblowers,  creating  an  environment,  which  has  the  potential  to 
encourage  whistleblowing,  although  more  often  than  not  serves  to  discourage 
whistleblowing.  Zimbardo  calls  this  the  “institutionalized  evil  of  inaction”  (Zimbardo, 
2007).  Although  indirect  and  often  more  subtle,  group  influence  is  significant  and  can 
cause  people  to  do  things  they  might  not  ordinarily  do  on  their  own  (Zimbardo,  2007). 
Group  influence  plays  off  human  nature  and  what  C.  S.  Lewis  calls  “the  terror  of  being 
left  outside”  (Zimbardo,  2007),  combining  external  forces,  such  as  peer  pressure  with  the 
internal  desire  to  be  part  of  the  “in  group.”  In  both  Muzafer  Sherif  s  initial  studies  on 
conformity,  and  Solomon  Asch’s  follow  up  studies,  the  results  demonstrated  that  more 
often  than  not,  people  will  give  up  their  independent  positions  and  follow  a  group 
mentality,  even  when  they  know  the  group  is  wrong  (Zimbardo,  2007).  The  desire  to  be 
part  of  the  group  and  not  ‘rock  the  boat’  overwhelmed  their  independence,  as  the 
psychological  costs  associated  with  autonomy  were  too  great. 

Stanley  Milgram,  who  built  upon  the  foundations  of  Asch’s  studies  and  shifted 
the  focus  to  determine  how  far  someone  would  go  under  orders,  has  explored  the  extent 
to  which  authority  figures  have  influence  over  people.  In  his  first  experiment,  Milgram 
demonstrated  how  65%  of  people  would  follow  orders  completely,  despite  expert 
predictions  of  less  than  1%  compliance  (Zimbardo,  2007).  Over  the  course  of  a  year, 
Milgram  conducted  19  different  experiments  in  which  he  varied  social  psychological 
factors  and  measured  their  influence  over  his  subjects.  His  data  demonstrate  it  is  possible 
to  create  an  environment  through  a  careful  application  of  certain  situational  factors  in 
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which  almost  anyone  could  be  either  totally  obedient  or  resistant  to  authority  pressures 
(Zimbardo,  2007).  The  obedience  effect  demonstrated  through  these  results  have  been 
replicated  by  a  number  of  subsequent  studies,  further  demonstrating  the  power  influence 
that  authority  figures  possess  over  subordinates. 

Group  influence  and  authority  influence  are  not  only  able  to  cause  action,  but  they 
are  also  able  to  create  an  environment  condueive  to  inaction,  which  can  sometimes  be 
even  more  damaging.  Zimbardo  deseribes  this  influence  as  the  “Institutionalized  Evil  of 
Inaction,”  stating  that  “in  situations  where  evil  is  being  praeticed... there  are  often 
observers  of  the  ongoing  activities  or  people  who  know  what  is  going  on  and  do  not 
intervene  to  help  or  challenge  the  evil  and  thereby  enable  evil  to  persist  by  their  inaetion” 
(Zimbardo,  2007).  Bystander  apathy,  as  demonstrated  by  the  Kitty  Genovese  Case,  is  an 
unfortunate  example  of  this.  In  1964,  38  people  in  Queens,  New  York  watehed  and  did 
nothing  as  Kitty  Genovese  was  killed  outside  her  apartment  (Johnson,  2003).  While  more 
reeent  analysis  of  the  ease  casts  some  doubt  on  how  many  people  actually  saw  the  murder 
taking  plaee,  no  question  exists  that  many  people  heard  the  screams  and  still  did  not  act 
(Zimbardo,  2007).  Two  factors  help  explain  the  lack  of  action  by  the  witnesses:  the  need 
for  interpretation  ereated  by  ambiguity,  and  the  fact  that  if  others  appear  unconeemed,  the 
less  likely  any  one  person  will  react  (Johnson,  2003).  These  faetors  are  also  prominent  in 
the  whistleblowing  environment,  where  ambiguity  and  the  pressure  not  to  break  rank 
often  combine  and  influence  people  away  from  whistleblowing.  A  former  government 
employee  once  stated,  “being  a  Demoerat  or  Republican  is  just  a  party  affiliation.  ‘Don’t 
Make  Waves’  is  a  religion”  (Johnson,  2003). 

[W]e  must  learn  that  passively  to  aceept  an  unjust  system  is  to  cooperate 

with  that  system,  and  thereby  become  a  partieipant  in  its  evil 

-  Dr.  Martin  Luther  King,  Jr.  (Zimbardo,  2007) 

Just  as  situational  forees  can  push  both  action  and  inaction,  so  too  can  they 
promote  heroism,  as  well  as  evil.  Commenting  on  the  ‘banality  of  heroism,’  Zimbardo 
remarks  that  the  perpetrators  of  evil  and  heroism  alike  are  just  eommon,  ordinary  people; 
and  that  while  neither  attribute  is  the  result  of  unique  dispositional  tendencies,  both 
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conditions  (evil/heroism)  emerge  in  partieular  situations  and  at  partieular  times  when 
situational  forces  come  together  to  influenee  individuals  to  action  (or  inaction) 
(Zimbardo,  2007).  The  research  by  Miethe  into  a  “whistleblowing  personality”  eonfirms 
that  Dr.  Zimbardo ’s  statement  rings  true  for  whistleblowing  as  well.  Whistleblowing  is 
eelebrated  in  The  Lucifer  Effect  as  a  subtype  of  ‘soeial  heroism,’  speeifieally  defined  as 
“individuals  who  are  aware  of  illegal  or  unethieal  aetivities  in  an  organization  who  report 
the  aetivity  without  expeetation  of  reward”  and  risk  “jeopardizing  earefully  groomed 
eareers,  professional  ostraeism,  loss  of  soeial  status,  finaneial  losses,  loss  of  eredibility, 
and  physieal  reprisal”  (Zimbardo,  2007). 

Despite  the  eurrent  environment  being  dominated  by  overwhelming  pressure  to 
eonform  and  organizational  loyalty  prioritized  and  reinforeed  by  authority  figures,  steps 
ean  be  taken  to  modify  the  environment  to  be  more  eondueive  to  whistleblowing. 
Zimbardo,  diseussing  the  possibility  of  a  ‘Reverse-Milgram  Altruism  Effeet,’  provides  a 
10-step  proeess  to  resist  unwanted  influenees  (Zimbardo,  2007).  Many  of  the  10  steps  he 
proposes  are  applicable  to  the  whistleblowing  environment  and  should  be  promoted 
vigorously  by  homeland  seeurity  leadership,  whieh  ineludes  promoting  (and  exhibiting) 
aeeountability  and  personal  responsibility,  eritieal  thinking,  individuality  and  vigilanee. 
The  fourth  of  Dr.  Zimbardo ’s  10  steps  is  “I  will  assert  my  unique  identity,”  and  it 
emphasizes  that  “anonymity  and  seerecy  eoneeal  wrongdoing  [and]  undermine  the  human 
eonneetion”  (Zimbardo,  2007),  whieh  is  one  area  of  foeus  where  Zimbardo’s  eonelusions 
are  eontrary  to  that  faetor’s  role  in  the  whistleblowing  environment.  Signifieant  researeh 
has  been  eondueted  into  how  deindividuation  and  anonymity  lead  to  inereased  aggression 
and  destruetiveness.  “Deindividuation  ereates  a  unique  psyehologieal  state  in  whieh 
behavior  eomes  under  the  eontrol  of  immediate  situational  demands  and  biologieal, 
hormonal  urges.  Action  replaces  thoughf’  (Zimbardo,  2007),  whieh  has  also  been 
researched  in  the  eontext  of  internet  interactions,  specifically  dubbed  the  ‘Online 
Disinhibition  Effeef  (Suler,  2004).  This  theory  attributes  six  faetors:  dissoeiative 
anonymity,  invisibility,  asynehronieity,  solipsistic  introjeetions,  dissoeiative  imagination, 
and  minimization  of  authority,  whieh  eombine  to  faeilitate  people  saying  and  doing 

things  online  that  they  would  not  ordinarily  do  in  faee-to-faee  diseussions  (Suler,  2004). 
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In  his  article  on  Online  Disinhibtion,  John  Suler  discusses  two  types  of  disinhibition, 
benign  and  toxie.  Toxic  disinhibition  is  consistent  with  Zimbardo’s  assessment  of 
deindividuation  and  anonymity  contributing  to  “rude  language,  harsh  criticisms,  anger, 
hatred,  and  even  threats”  (Suler,  2004).  However,  the  research  on  whistleblowing 
suggests  that  not  only  can  anonymity  promote  ‘benign  disinhibition’  (the  act  of  showing 
unusual  kindness  or  generosity  to  others)  (Suler,  2004),  but  in  situations  in  which  group 
and/or  authority  pressure  occurs  to  NOT  stand  out  or  ‘make  waves,’  anonymity  ean 
aetually  promote  breaking  rank  and  whistleblowing  (Miethe,  1999) — defined  by 
Zimbardo  as  a  heroie  act.  By  affording  the  availability  of  increased  anonymity  in 
authorized  whistleblower  submission  proeesses,  it  is  likely  that  the  amount  of 
whistleblowing  overall  would  increase. 

E.  THE  IMPORTANCE  OF  WHISTLEBLOWING 

Modern  soeiety,  as  a  whole,  aeeepts  and  understands  that  misdeeds  and 
wrongdoing  oceur,  and  implements  measures  to  identify  and  correct  those  actions. 
Through  the  establishment  of  Inspectors  General  (IG),  GAO  and  Internal  Affairs  in  the 
public  sector,  and  both  internal  and  external  auditing  bodies  in  the  private  sector, 
organizations  conduct  self-evaluations  and  submit  to  outside  oversight.  Whistleblowing  is 
an  important  part  of  this  process,  as  whistleblowers  are  in  a  unique  position  to  observe 
miseonduct  in  their  organizations  (Miethe,  1999).  Multiple  studies  have  been  conducted 
on  fraud  detection,  and  not  only  have  the  results  of  these  studies  supported  the  role  of 
whistleblowers  in  deteeting  fraud,  they  even  go  as  far  to  identify  whistleblowers  as  the 
“single  most  effective  source  of  information  in  both  detecting  and  rooting  out  corporate 
eriminal  activity”  (Kohn,  2011).  PricewaterhouseCoopers  conducted  a  study  in  2007  that 
identified  that  whistleblowers  uncovered  43%  of  corporate  fraud  (National 
Whistleblowers  Center,  2010),  while  auditors  uncovered  19%,  and  law  enforeement  3% 
(Kohn,  2011).  A  2010  study  by  the  Assoeiation  of  Certified  Fraud  Examiners  on  Global 
Fraud  concluded,  “tips  were  by  far  the  most  common  detection  method.  In  our  study, 
catehing  nearly  three  times  as  many  frauds  as  any  other  form  of  detection... not 
surprisingly,  employees  were  the  most  common  source  of  fraud  tips”  (Kohn,  2011). 
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Whistleblowing  allows  organizations  to  identify  issues,  whieh  can  result  in  both 
financial  savings  and  reduction  of  the  potential  for  negative  publicity  and  public 
backlash.  Both  Department  of  Defense  (DoD)  and  the  GAO  have  established  fraud  ‘hot 
lines’  to  promote  whistleblowing  and  accountability  in  government  affairs.  In  1998,  DoD 
estimated  that  submissions  to  their  IG  hotline  resulted  in  an  average  of  $15  million  per 
year  (Miethe,  1999).  In  2011,  the  Justice  Department  recovered  more  than  $3  billion 
under  the  False  Claims  Act  (Gamble,  2011),  including  the  case  of  a  company  called 
American  Grocers.  This  company  was  buying  expired  food  at  discounted  rates,  changing 
the  dates  on  the  food,  and  selling  the  food  to  the  government  at  a  significant  markup.  This 
food  was  to  be  served  to  American  troops  fighting  in  Iraq.  The  owner  of  the  company 
was  sentenced  to  24  months  in  prison,  and  the  Department  of  Justice  reached  a  $15 
million  settlement  with  the  company  (Department  of  Health  and  Human  Services,  2011). 
Delma  Pallares,  a  whistleblower,  initiated  the  government’s  investigation  into  American 
Grocers  (Knight,  2010).  Thus,  whistleblowers  play  a  critical  role  in  the  identification  of 
fraud  and  wrongdoing.  Of  the  $3  billion  recovered  in  201 1  by  the  Department  of  Justice, 
$2.8  billion  of  that  amount  (93%)  was  investigated  as  a  result  of  whistleblowers  (Gamble, 
2011).  This  situation  exemplifies  Zimbardo’s  10th  step,  appropriately  entitled,  “I  can 
oppose  unjust  systems”  (Zimbardo,  2007).  This  mentality,  above  all,  needs  to  be 
supported  in  government.  The  idea  that  ‘one  person  can  make  a  difference’  should  be 
promoted  and  reinforced  using  both  authority  influence  and  group  influence.  The  goal 
should  be  to  change  the  homeland  security  culture  to  support  speaking  out,  and 
developing  processes,  which  reduce  personal  risk  to  employees.  It  is  only  through  the 
modification  of  the  situational  factors  affecting  potential  whistleblowers  that  the  DHS 
will  be  able  to  inspire  more  whistleblowers  and  more  heroes. 
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III.  ANALYSIS 


A.  CURRENT  STATE  OF  THE  ENVIRONMENT:  AUTHORIZED 

PROCESSES  AND  PROTECTIONS  FOR  WHISTLEBLOWING 

1.  U.S,  Whistleblowing  Policies 

Whistleblowing  in  the  United  States  is  a  eomplieated  and  risky  proposition,  with 
no  fewer  than  15  federal  laws  and  upwards  of  44  state  laws,  whieh  address  the  issue  in 
some  way.  Over  the  past  few  years,  in  partieular,  publie  awareness  of  whistleblowing  has 
inereased  signifieantly;  however,  many  misconeeptions  exist  regarding  the  proeess  and 
proteetions  provided  to  whistleblowers  in  the  United  States.  As  the  extent  of  U.S.  law  and 
poliey  on  the  issue  of  whistleblowing  prevents  an  all-inelusive,  in-depth  review,  this 
analysis  focuses  on  the  primary  legislation  impacting  federal  homeland  security 
employees. 

As  defined  by  5  U.S.C.  §  2302(b)  (United  States  Code),  it  is  a  prohibited  practice 
for  the  government  to  engage  in  reprisal  for  whistleblowing — generally,  a  person  with 
personnel  authority  cannot  take  or  fail  to  take  a  personnel  action  with  respect  to  an 
employee  or  applicant  because  of  a  disclosure  of  information  by  the  employee  or 
applicant  that  he  or  she  reasonably  believes  evidences  a  violation  of  a  law,  rule  or 
regulation;  gross  mismanagement;  gross  waste  of  funds;  an  abuse  of  authority;  or  a 
substantial  and  specific  danger  to  public  health  or  safety.  The  prohibition  does  not  apply, 
however,  if  the  disclosure  is  barred  by  law  or  is  specifically  required  by  Executive  Order 
(E.O.)  to  be  kept  secret  in  the  interest  of  national  defense  or  the  conduct  of  foreign 
affairs,  except  when  such  a  disclosure  is  made  to  the  Special  Counsel,  the  IG,  or  a 
comparable  agency  official  (U.S.  Office  of  Special  Counsel,  n.d.). 

The  underlying  basis  for  whistleblower  protection  is  often  identified  as  a 
constitutional  right,  having  been  established  within  the  Bill  of  Rights,  specifically,  the  1st 
Amendment.  Whistleblowing  could  certainly  be  considered  a  principle  in  practice  with 
regard  to  freedom  of  speech.  However,  severe  restrictions  are  placed  upon  federal 
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employees  that  signifieantly  limit  their  ability  to  diselose  information  in  the  first  plaee 
(e.g.,  government  seerets/elassified  information),  mandating  that  they  use  internal 
administrative  proeesses  instead  of  legal  aetion. 

Significant  case  law  serves  to  complicate  the  matter  further.  Garcetti  v.  Ceballos^ 
(2006)  established  that  the  protection  under  the  1st  Amendment  is  limited  when  speech  is 
part  of  “official  duties”  (U.S.  Supreme  Court,  2006);  however,  subsequent  rulings  in 
Posey  V  Lake  PencP  (2008),  Marable  v.  Mark^  (2007),  and  Thomas  v.  City  of  Blanchard^ 
(2008),  have  been  conflicting.  Furthermore,  the  Civil  Rights  Act  provides  further  support 
to  the  protections  established  in  the  1st  Amendment.  However,  federal  law  upholds  the 
right  of  the  president  to  classify  information  and  restrict  its  dissemination,  severely 
impacting  the  protections  provided  to  homeland  security  whistleblowers  within  the 
constitution,  which  is  an  important  example  of  how  outside  factors  (e.g.,  legal  rulings, 
agency  actions,  etc.)  can  have  a  significant  impact  on  the  interpretation  and 
implementation  of  whistleblowing  law. 

Outside  of  constitutional  rights,  the  primary  law,  which  governs  federal 
whistleblowers,  is  the  Civil  Service  Reform  Act  (CSRA)  and  the  subsequent  WPA.  The 
CSRA  was  established  in  1978  and  is  generally  acknowledged  as  one  of  the  weaker 
whistleblower  laws  (Kohn,  2011),  and,  as  such,  it  has  seen  multiple  amendments.  The 


1  In  this  2006  case  of  a  district  attorney  (Ceballos)  who  claimed  he  was  retaliated  against  for  criticizing 
the  legitimacy  of  a  warrant,  the  court  mled  (in  a  5-4  decision)  that  because  his  statements  were  made  as  a 
public-employee  and  not  as  a  citizen,  he  retained  no  1st  Amendment  protection  (Duke  Law). 

2  This  2008  case  heard  by  the  9th  Circuit  Court  of  Appeals,  dealt  with  a  ‘security  specialist’  employed 
by  a  school  district  (Posey)  who  expressed  concerns  to  the  school  district  regarding  school  safety  and 
inadequate  emergency  plans.  Posey  suffered  retaliation,  and  the  district  court  ruled  that  his  actions  did  not 
receive  1st  Amendment  protections  per  the  Garcetti  case.  In  this  case,  the  appeals  court  overturned  the 
district  court’s  decision  (The  Recorder,  2008). 

^  In  2007,  Ken  Marable,  a  Washington  State  Ferry  engineer,  appealed  a  prior  District  Court  ruling  that 
his  speaking  out  against  corruption  was  not  protected  under  the  1st  Amendment.  As  in  the  Posey  case,  the 
9th  Circuit  Court  of  Appeals  overturned  the  District  Court’s  decision  (United  States  Court  of  Appeals, 
Ninth  Circuit,  2007). 

^  In  this  2008  case  heard  by  the  10th  Circuit  Court  of  Appeals,  the  court  overturned  a  District  Court 
mling  that  Ira  Thomas  (a  building  code  inspector  for  the  City  of  Blanchard  Oklahoma)  was  not  protected 
under  the  1st  Amendment  for  reporting  suspected  illegality  per  Garcetti  (United  States  Court  of  Appeals, 
Tenth  Circuit,  2008). 
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CSRA  established  the  Office  of  Special  Counsel  (OSC)  to  protect  whistleblowers  from 
retaliation,  while  the  Merit  Systems  Protection  Board  (MSPB)  was  authorized  to  hear  and 
adjudicate  reprisal  complaints  from  whistleblowers  (Lewis,  2010).  Under  this  process, 
any  appeals  to  the  ruling  of  the  MSPB  are  taken  to  the  Federal  Circuit  Court. 
Unfortunately,  under  CSRA,  up  to  90%  of  whistleblowers  lost  appeals  within  the 
OSC/MSPB  process,  resulting  in  a  signihcant  decrease  of  whistleblowing  over  time 
(Lewis,  2010).  To  address  this  problem.  Congress  passed  the  Whistleblower  Protection 
Act  in  1989,  which  took  steps  to  strengthen  the  OSC  as  an  independent  body;  allowed  for 
whistleblowers  to  take  individual  action  if  the  OSC  chose  not  to  take  their  case  to  the 
MSPB,  and  eased  the  burden  of  proof  on  the  employee  to  demonstrate  that  adverse 
treatment  was  due  to  whistleblowing  (Miethe,  1999).  Despite  the  attempts  by  Congress  to 
address  loopholes  and  shortcomings  in  the  CSRA/WPA,  major  shortfalls  continue  to 
hamper  legislation  because  of  the  interpretation  of  the  laws  by  the  courts  and  the 
implementation  of  laws  by  responsible  agencies  (OSC,  MSPB,  etc.).  The  Senate 
Committee  report  on  the  WPA  even  went  so  far  as  to  state,  “The  Committee  intends  that 
disclosures  be  encouraged.  The  OSC  [Office  of  Special  Counsel],  the  [Merit  Systems 
Protection]  Board,  and  the  courts  should  not  erect  barriers  to  disclosures  which  will  limit 
the  necessary  flow  of  information  from  employees  who  have  knowledge  of  government 
wrongdoing.  For  example,  it  is  inappropriate  for  disclosures  to  be  protected  only  if  they 
are  made  for  certain  purposes  or  to  certain  employees  or  only  if  the  employee  is  the  first 
to  raise  the  issue”  (U.S.  Senate,  2002).  Despite  what  would  appear  to  be  clear  guidance  in 
support  of  whistleblowers,  currently  policies  do  not  provide  protections  to  employees 
who  report  wrongdoing  in  their  chain  of  command,  tell  co-workers  or  those  suspected  of 
wrongdoing,  challenge  policies,  are  dictated,  by  virtue  of  their  job  description  to  find  or 
point  out  wrongdoing;  or  are  not  the  first  to  raise  the  problem.  The  impact  of  these 
loopholes  is  demonstrated  by  the  fact  that  since  1999,  approximately  94%  of 
whistleblowers  have  lost  appeals  within  the  OSC/MSPB  process,  and  whistleblowers 
have  won  only  three  cases  out  of  202  at  the  Federal  Circuit  Court  of  Appeals  since 
October  1994  (Schwehenbach,  n.d.). 
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It  is  important  to  note  that  while  the  CRSAAVPA  provides  proteetion,  albeit 
limited,  to  federal  employees,  a  “national  security”  exemption  does  exist.  As  defined  by 
the  Notification  and  Federal  Employee  Antidiscrimination  and  Retaliation  Act  of  2002, 
any  employee  who  works  for  “the  Federal  Bureau  of  Investigation,  the  Central 
Intelligence  Agency,  the  Defense  Intelligence  Agency,  the  National  Geospatial- 
Intelligence  Agency,  the  National  Security  Agency,  and,  as  determined  by  the  President, 
any  Executive  agency  or  unit  thereof  the  principal  function  of  which  is  the  conduct  of 
foreign  intelligence  or  counterintelligence  activities  (United  States  Code)”  is  exempted, 
and  therefore,  not  covered  by  the  WPA.  While  the  DHS  is  not  specifically  identified  in 
the  legislation,  instances  occur  when  the  Transportation  Security  Administration  (a 
component  of  DHS)  is  specified  as  not  being  covered  in  the  WPA,  and  clearly  other 
components  of  DHS  fall  within  the  realm  of  ‘intelligence  collection.’  Section  463  of  the 
Homeland  Security  Act  of  2002  states  that  pursuant  to  the  exemptions  identified  above, 
“nothing  in  this  charter  shall  be  construed  as  exempting  the  Department  from 
requirements  applicable  with  respect  to  executive  agencies — (1)  to  provide  equal 
employment  protection  for  employees  of  the  department  (United  States  Code).”  This 
situation  appears  to  be  circular  logic,  stating  that  homeland  security  is  not  exempt  from 
these  protections,  except  when  it  is  exempt  from  these  protections.  In  an  attempt  to 
address  the  issues  associated  with  exempt  agencies.  Congress  established  the  Intelligence 
Community  Whistleblower  Protection  Act  of  1998,  which  served  to  reinforce  its  right  to 
receive  classified  information  from  whistleblowers  in  the  intelligence  IC  and  allows  for 
the  Office  of  the  IG  to  investigate  whistleblower  retaliation.  Unfortunately,  the  ICWPA 
does  not  provide  any  protections  to  whistleblowers;  rather  it  is  only  focused  on 
procedures.  The  Federal  Bureau  of  Investigation  (FBI)  has  its  own  whistleblower 
protection  statute,  which  also  identifies  the  process  through  which  FBI  whistleblowers 
can  submit  information  and  the  organizations  responsible  for  the  investigation  of 
whistleblower  retaliation  claims.  As  discussed  above,  despite  the  intent  of  Congress 
through  legislation,  the  interpretation  and  implementation  of  policies  falls  to  individual 
agencies  that  have  consistently  demonstrated  a  lack  of  support  for  whistleblowers. 
Senators  Grassley  and  Feahy  even  sent  a  letter  to  FBI  director  Mueller  identifying  a 
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“concern. .  .that  the  latest  investigation  was  a  sign  of  the  FBI’s  apparent  haste  to  launeh  an 


OPR  probe  every  time  an  agent  speaks  publiely  about  problems  within  the  FBI” 
(Grassley,  2004). 

The  aforementioned  U.S.  policies  only  aeeount  for  a  fraetion  of  the  total  federal 
policies  in  place  regarding  whistleblowers.  A  number  of  laws  exist  that  are  designed  to 
ineentivize  whistleblowing,  partieularly  in  oases  in  which  the  government  is  being 
overoharged  or  defrauded.  Under  the  False  Claims  Aot,  whistleblowers  oan  reoeive 
oompensation,  to  inolude  a  peroentage  of  the  total  money  returned  from  the  disolosure,  as 
a  reward.  The  Frank-Dodd  Aot  and  the  amended  Sarbanes-Oxley  Aot,  provide  provisions 
for  whistleblowers  to  reoeive  rewards  for  reporting  fraud  in  the  financial  sector.  While 
these  do  not  necessarily  apply  to  the  homeland  security  employee,  (with  the  exoeption  of 
the  False-Claims  Aot),  Frank-Dodd  and  Sarbanes-Oxley  demonstrate  an 
aoknowledgement  by  the  government  that  whistleblowing  is  important  and  should  not 
only  be  proteoted,  but  rewarded  as  well. 

2,  International  Policies  for  Whistleblowing 

Despite  the  intent  of  Congress  to  support  whistleblowing  through  the 
establishment  of  legislation,  the  United  States  remains  behind  muoh  of  the  international 
community  in  providing  the  neoessary  guidance,  inoentives,  and  proteotions  required  to 
promote  authorized  whistleblowing.  Through  a  review  of  international  polieies  on 
whistleblowing,  it  may  be  possible  to  identify  best  praetiees  that  would  be  beneficial  for  a 
U.S.  solution.  The  following  four  countries  serve  as  a  representative  sample  of  foreign 
whistleblower  policies,  and  provide  useful  information  on  promising  praetiees  and 
lessons  learned. 


a.  United  Kingdom 

Whistleblowers  in  the  United  Kingdom  (UK)  are  covered  primarily  under 
a  single  law,  the  Publie  Information  Diselosures  Aot  (PIDA)  that  came  into  effect  July  2, 
1999.  PIDA  is  defined  within  its  preamble  as  “an  Aot  to  protect  individuals  who  make 
certain  disclosures  of  information  in  the  public  interest;  to  allow  suoh  individuals  to  bring 
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action  in  respect  of  victimisation  and  for  connected  purposes”  (Government  of  the  United 
Kingdom,  1998).  While  some  similarities  oeeur  with  the  WPA  and  U.S.  whistleblowing 
policies,  PIDA  presents  a  number  of  interesting  and  distinctly  different  approaches  to 
whistleblower  protections.  PIDA  provides  coverage  to  all  workers  aeross  all  sectors, 
including  temporary  agency  staff  and  contractors,  home  workers,  police  officers  and 
every  professional  in  the  National  Health  Serviee.  No  minimum  qualifiers  exist  (sueh  as 
age  and  time  of  employment),  however,  like  the  U.S.  WPA,  it  does  not  eover  intelligenee 
services  and  the  armed  forces  (Public  Concern  At  Work,  n.d.).  If  proteeted  employees 
suffers  retaliation  or  are  vietimized  as  a  result  of  their  act,  they  are  eligible  to  bring  a 
elaim  before  an  Employment  Tribunal,  whieh  can  award  damages  (currently  uncapped) 
based  on  the  loss  suffered,  including  the  potential  for  additional  compensation  for 
aggravated  damages  and  injury  to  feelings  (Public  Concern  At  Work,  n.d.).  Victimization 
can  include  dismissal,  or,  “any  detriment  by  any  act,  or  any  deliberate  failure  to  aet,  by 
his  employer  done  on  the  ground  that  the  worker  has  made  a  protected  disclosure” 
(Government  of  the  United  Kingdom,  1998).  PIDA  defines  protected  whistleblowing 
when  1)  a  eriminal  offense  has  been  committed,  is  being  committed  or  is  likely  to  be 
committed,  2)  a  person  has  failed,  is  failing  or  is  likely  to  fail  to  comply  with  any  legal 
obligation  to  which  he  is  subject,  3)  a  miscarriage  of  justice  has  oecurred,  is  oeeurring  or 
is  likely  to  oeeur,  4)  the  health  or  safety  of  any  individual  has  been,  is  being  or  is  likely  to 
be  endangered,  5)  the  environment  has  been,  is  being  or  is  likely  to  be  damaged,  or  6) 
information  tending  to  show  any  matter  falling  within  any  one  of  the  preeeding 
paragraphs  has  been,  is  being  or  is  likely  to  be  deliberately  eoncealed. 

Whistleblowing  policies  in  the  UK  were  developed  in  an  attempt  to  find 

the  balance  between  the  proteetion  and  promotion  of  public  interest  disclosures  and  the 

importance  of  organizational  secrecy  in  free  enterprise.  The  primary  eoncem  remains  that 

whistleblower  protections  could  be  used  to  cover  industrial  espionage  (Lewis,  2010).  To 

aehieve  a  compromise,  PIDA  establishes  a  ‘three-tiered’  approaeh  for  whistleblowers  to 

report  information.  The  first  tier  addresses  what  is  often  defined  as  ‘internal 

whistleblowing,’  or  reporting  the  observed  or  suspeeted  wrongdoing  within  the  agency, 

organization  or  company.  Unlike  the  U.S.  WPA,  PIDA  automatically  provides  protection 
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to  internal  whistleblowers  (as  long  as  they  meet  the  required  eriteria),  and  allows  for 
internal  reporting  either  within  or  outside  of  their  hierarehy/chain  of  eommand.  For  a 
diselosure  to  be  proteeted  at  the  first  tier,  the  criterion  is  that  the  whistleblower  has  “a 
reasonable  belief  the  information  tends  to  show  that  malpractice  has  occurred,  is 
occurring  or  is  likely  to  occur”  (Lewis,  2010). 

The  second  tier  in  the  UK  process  allows  for  disclosures  to  regulatory 
authorities,  including  the  Financial  Services  Authority,  the  Health  and  Safety  Executive 
or  the  Care  Quality  Commission  (Public  Concern  At  Work,  2010).  While  this  tier  is 
traditionally  defined  as  ‘external  whistleblowing’  or  reporting  the  observed  or  suspected 
wrongdoing  outside  of  the  agency,  this  second  tier  allows  external  whistleblowing  to 
occur  in  the  absence  of  going  to  the  broader  public  or  society  at  large.  By  establishing  a 
‘proxy  for  society’  (Lewis,  2010),  whistleblowers  are  given  an  alternative  avenue  to 
report  wrongdoing  without  truly  exposing  those  concerns  to  the  broader  public,  as  is  the 
case  with  traditional  external  whistleblowing.  For  a  disclosure  to  be  protected  at  the 
second  tier,  whistleblowers  must  meet  the  criteria  prescribed  for  the  first  tier. 
Additionally,  the  whistleblower  has  to  reasonably  believe  “that  the  information  and  any 
allegation  in  it  are  substantially  true  and  is  relevant  to  that  regulator  (the  organization  to 
which  the  disclosure  is  made)”  (Public  Concern  At  Work,  n.d.). 

Lastly,  in  certain  circumstances  in  which  a  valid  cause  exists  to  do  so  or 
the  previous  two  tiers  have  failed,  wider  public  disclosures  will  be  protected  (including  to 
the  media),  as  long  as  the  disclosures  meet  the  criteria  for  the  first  and  second  tiers  and 
“are  reasonable  in  all  circumstances  and  are  not  made  for  personal  gain”  (Public  Concern 
At  Work,  n.d.).  Additionally,  the  disclosures  must  fall  within  one  of  the  following 
categories:  “the  whistleblower  reasonably  believed  he  would  be  victimized  if  he  had 
raised  the  matter  internally  or  with  a  prescribed  regulator;  there  was  no  prescribed 
regulator  and  he  reasonably  believed  the  evidence  was  likely  to  be  concealed  or 
destroyed;  the  concern  had  already  been  raised  with  the  employer  or  a  prescribed 
regulator;  or  the  concern  was  of  an  exceptionally  serious  nature”  (Public  Concern  At 
Work,  n.d.).  Reasonable  disclosures  are  further  evaluated  based  on  the  following 
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circumstances:  “the  identity  of  the  person  to  whom  it  was  made;  the  seriousness  of  the 
concern;  whether  the  risk  or  danger  remains;  and  whether  the  disclosure  breaehed  a  duty 
of  eonfidence  whieh  the  employer  owed  a  third  party.  Where  the  concern  has  been  raised 
with  the  employer  or  a  prescribed  regulator,  the  tribunal  will  also  consider  the 
reasonableness  of  their  response.  Finally,  if  the  concern  has  been  raised  with  the 
employer,  the  tribunal  will  eonsider  whether  any  whistleblowing  proeedure  in  the 
organization  was  or  should  have  been  used”  (Public  Concern  At  Work,  n.d.). 

By  using  this  tiered  approach,  PIDA  not  only  provides  eneouragement  to 
whistleblowers  through  its  protections,  it  also  serves  to  hold  organizations  aecountable 
for  taking  corrective  aetions  to  address  wrongdoing  and  to  proteet  the  whistleblower.  If 
the  first  tier  (the  organization  itself)  fails  to  act,  the  seeond  tier  serves  as  a  watehdog  to 
ensure  the  issues  are  handled  appropriately.  Should  the  second  tier  fail  in  its 
responsibilities  to  hold  the  first  tier  aeeountable,  the  third  tier  serves  to  provide  the  same 
pressure  and  accountability  (Lewis,  2010).  By  providing  proteetion  to  those  who  report 
internally  and  identifying  consequences  for  retaliation,  the  PIDA  encourages  employers 
to  establish  a  clear  process  for  whistleblowers  and  avoid  retaliatory  practiees. 

b.  Belgium 

Whistleblowers  in  Belgium,  also  called  “denunciators”  (Council  of 
Europe — Committe  on  Legal  Affairs  and  Human  Rights,  2008),  are  afforded  some 
protections  based  on  the  May  7,  2004  Whistleblowers  Deeree.  This  decree  states  that  any 
eivil  servants  can  raise  issues  of  negligence,  abuse  or  irregularities  (Council  of  Europe — 
Committe  on  Eegal  Affairs  and  Human  Rights,  2008)  to  their  supervisors,  or  directly  to 
the  internal  auditing  component  of  the  Elemish  Administration  if  their  supervisor  is 
involved  in  the  wrongdoing  (Eewis,  2010).  If  the  whistleblower  experienees  retaliation  or 
no  movement  on  the  issue  oecurs  within  30  days,  the  issue  can  be  submitted  to  the 
Elemish  Ombudsman.  Once  under  the  protection  of  the  government/ombudsman,  any 
disciplinary  actions  against  the  whistleblower  are  suspended,  and  proteetion  lasts  until 
two  years  after  the  end  of  the  investigation.  Belgium  goes  further  to  support  transpareney 
by  requiring  the  Elemish  Ombudsman  to  report  annually  on  all  whistleblowing  oases 
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received,  the  status  of  the  investigation  and  the  ultimate  findings.  From  2006-2008,  all 
cases  submitted  to  the  Flemish  Ombudsman  received  protection  from  retaliation  (Lewis, 
2010). 


c.  Romania 

Whistleblower  protection  in  Romania  was  established  with  Law  No.  571 
of  December  14,  2004,  “regarding  the  protection  of  personnel  within  public  authorities, 
public  institutions  and  other  establishments,  who  report  infringements”  (Romanian 
Parliament,  2004).  Romanian  whistleblower  protections  have  some  similarities  to  the 
UK’s  PIDA,  however,  while  the  UK  legislation  is  balanced  between  the  needs  of  the 
public  and  the  needs  of  institutions/organizations,  Romanian  law  favors  the  needs  of  the 
public.  The  law  was  established  to  protect  members  of  “public  authorities  and 
institutions,  the  central  public  administration,  local  public  administration,  the  government 
apparatus,  public  institutions,  national  companies,  and  autonomous  administrations  of 
national  and  local  interest... [who] expose  or  report  law  infringements  within  public 
authorities,  public  institutions  and  other  establishments,  perpetrated  by  persons  in  leading 
or  operational  positions  within  public  authorities  and  institutions”  (Romanian  Parliament, 
2004).  Law  571  stresses  eight  overarching  principles,  including  legality,  public  interest 
supremacy,  responsibility,  non-abusive  sanctioning,  good  administration,  good  conduct, 
balance,  and  good  faith.  Each  of  these  principles  provides  guidance  for  the  conduct  of 
whistleblowers,  as  well  as  for  organizations,  agencies  and  the  government. 
Whistleblowers  are  required  (under  the  principle  of  responsibility)  to  provide  data  or 
facts  regarding  the  reported  issue  (Romanian  Parliament,  2004),  and  can  report  to  any  of 
the  following;  their  supervisor,  the  head  of  their  agency/organization,  disciplinary 
committees  in  the  public  sector,  legal  bodies,  investigative  organizations,  parliament, 
mass-media,  professional  bodies,  trade  unions  or  employee  associations,  and  non¬ 
governmental  organizations  (Romanian  Parliament,  2004).  An  important  distinction 
between  PIDA  and  Romanian  law  571  is  that  while  reporting  through  each  tier  is  done 
consecutively  in  the  UK  (with  some  exception),  Romanian  whistleblowers  can  report  to 
any  of  the  above  organizations  “alternatively  or  cumulatively”  (Romanian  Parliament, 
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2004)  as  long  as  they  meet  the  established  requirements.  Romanian  law  also  provides  for 
the  ability  to  keep  the  whistleblowers  identity  seeret  if  the  person  accused  is  either  their 
direct  or  indirect  supervisor  (Lewis,  2010).  Uniquely,  Romanian  law  allows  for 
whistleblowers  to  demand  a  press  and  union  representative  be  present  at  any  disciplinary 
hearings  (Lewis,  2010). 

d.  Australia 

Currently,  no  single,  comprehensive  legislation  in  Australia  provides  for 
whistleblower  protection.  However,  eight  independent  acts  (laws)  that  range  from  1 993- 
2003  cover  eight  Australian  territories,  and  the  Public  Service  Act  of  1999,  which  covers 
the  Commonwealth.  Interestingly,  Australia  has  been  the  focal  point  for  a  significant 
whistleblowing  study.  The  “Whistling  While  They  Work”  (WWTW)  project  is  a  three- 
year  collaborative  national  research  project  into  the  management  and  protection  of 
internal  witnesses,  including  whistleblowers,  in  the  Australian  public  sector  (Griffith 
University,  n.d.).  As  part  of  its  study,  the  WWTW  team  identified  a  series  of  best 
practices  from  the  nine  total  Australian  acts,  which  included  the  following  key  points: 
whistleblower  laws  must  provide  multiple  avenues  for  disclosure,  clear  processes  for 
submission  should  be  identified,  the  role  of  disclosures  to  media/parliament  need  to 
defined,  and  Australia  should  pursue  completely  new  legislation  as  opposed  to  amending 
previous  acts.  The  WWTW  project  also  identified  the  need  for  sufficient  buy-in  and 
support  from  leadership  to  ensure  legislation  is  enacted,  and  ultimately,  enforced 
appropriately.  Much  like  the  United  States,  Australia  has  proposed  many  bills  to  address 
whistleblowing;  however,  none  of  them,  including  the  most  recent  Public  Interest 
Disclosures  Bill  of  2007,  has  passed  (The  Parliament  of  the  Commenweath  of  Australia, 
2007). 
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3,  International  Best  Practices  for  Whistleblowing  Policies 

Based  on  a  review  of  the  current  U.S.  whistleblowing  policies  and  the  best 
practices  evident  in  the  international  whistleblowing  policies  above,  the  United  States 
could  improve  six  areas  in  its  current  policies  by  adopting  some  international  best 
practices. 

•  Who  is  covered?  The  United  States  should  establish  a  clear 
whistleblowing  policy  for  civil  service  employees  of  the  U.S.  DHS,  its 
detailees  and  its  contractors.  This  single  policy  should  cover  all  DHS 
components,  including  those  identified  as  part  of  the  IC  and  the 
Transportation  Security  Administration.  Romanian  law  is  a  prime  example 
of  a  policy  that  covers  all  necessary  parties,  and  the  United  States  can 
benefit  from  leveraging  the  eight  principles  identified  in  Romanian  law  to 
help  shape  U.S.  policy.  Additionally,  U.S.  policy  should  specifically 
remove  the  requirement  to  be  the  first  to  report  wrongdoing. 

•  What  types  of  misconduct  for  reporting  are  covered?  It  is  a  tremendous 
challenge  to  write  any  policy  that  covers,  in  detail,  all  possibilities  and 
issues  that  could  potentially  qualify  as  misconduct.  While  the  current  U.S. 
policy  identifies  a  number  of  specific  categories  that  qualify  as  protected 
disclosures,  the  United  States  should  consider  including  the  phrase  “issues 
of  public  interest,”  as  identified  in  the  UK  PIDA. 

•  What  types  of  reprisals  for  reporting  are  covered?  As  with  the  question 
above,  it  is  nearly  impossible  to  identify  all  possible  reprisals  or  methods 
of  retaliation  that  could  possibly  be  used  punitively  against 
whistleblowers.  While  the  U.S.  language  currently  is  broad  with  the  use  of 
“personnel  action,”  clear  issues  exist  concerning  the  interpretation  or 
adherence  to  that  language,  particularly  in  terms  of  security  clearances. 
The  UK’s  PIDA  uses  the  word  “victimization”  to  define  reprisals  in  terms 
of  their  effect  on  the  whistleblower  as  opposed  to  the  employer.  While 
including  this  language  may  not  prevent  the  prohibited  actions  from  being 
taken  initially,  it  may  steer  the  investigation  and  adjudication  in  favor  of 
whistleblowers  and  the  U.S. /DHS  should  take  action  in  support  of  that 
objective. 

•  When  should  legal  protection  begin  and  should  there  be  a  statute  of 
limitations  for  filling  legal  action?  U.S.  policy  currently  puts  the  burden 
on  the  whistleblower  with  regard  to  filing  deadlines  and  requirements,  as 
well  as  limitations  on  when  protections  begin  and  end.  The  United  States 
should  learn  from  Belgium  and  establish  protection  from  the  time  of  the 
initial  submission  until  two  years  after  the  investigation  has  been 
completed. 
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•  How  should  employees  proceed  with  a  formal  complaint?  The  current 
U.S.  model  for  whistleblower  submissions  is  broken.  As  far  as 
international  best  practices  for  processes,  the  three-tiered  approach 
identified  by  the  UK’s  PIDA  is  by  far  the  most  effective  at  balancing  the 
needs  of  the  public  with  the  needs  for  the  organization/secrecy.  U.S. 
policies  do  not  currently  follow  a  tiered  process,  and  explicitly  do  not 
cover  internal  whistleblowing.  The  U.S./DHS  should  establish  a  multi¬ 
tiered  approach  using  similar  guidelines  as  identified  by  the  UK’s  PIDA, 
and  utilize  a  proxy  similar  to  the  Belgian  ombudsman. 

•  Tier-One:  Internal.  Internal  reporting  should  include  submissions 
within  the  originating  agency/component  (to  include  within  the 
whistleblower’s  chain  of  command)  to  the  department’s  Office  of 
the  IG  or  the  OSC. 

•  Tier-Two:  External — Proxy.  External  reporting  should  include 
submissions  to  Congress,  and  the  DHS  should  establish  a  third 
party  to  coordinate  on  behalf  of  the  whistleblower,  similar  to  the 
Flemish  Ombudsman.  This  coordinator  could  function  as  the  proxy 
for  society.  Both  Congress  and  the  third  party  could  serve  as 
oversight  and  function  as  external  auditing  organizations  over  tier- 
one  organizations,  working  with  them  to  ensure  the  wrongdoing  is 
addressed  and  to  prevent  reprisals/retaliation. 

•  Tier-Three:  External — Public.  In  circumstances  in  which  neither 
Congress  nor  the  third  party  is  able  to  facilitate  action  on  behalf  of 
the  whistleblower,  the  whistleblower  or  the  third  party  (after  a 
clearly  established  period  of  time)  would  have  the  option  of 
submitting  the  information  to  the  public/media.  The  whistleblower 
would  retain  protection  as  long  as  the  criteria  for  public  disclosure 
were  met  (identified  in  the  PIDA  and  above). 

•  Is  whistleblowing  incentivized?  U.S.  policies  are  currently  leading  the 
world  regarding  incentivizing  whistleblowing,  specifically,  under  the 
Frank-Dodd  and  Sarbanes-Oxley  Acts.  However,  those  policies  apply  to 
the  financial  sector  and  no  functional  equivalent  exists  for  homeland 
security  employees.  The  U.S./DHS  should  enhance  the  False  Claims  Act 
or  establish  an  incentive  program  to  provide  similar  rewards  to  homeland 
security  whistleblowers  as  is  provided  to  financial  whistleblowers  by  the 
Frank-Dodd  and  Sarbanes-Oxley  Acts. 

Based  on  the  realities  of  the  current  whistleblowing  environment  and  the  issues 
associated  with  the  authorized  processes,  employees  are  being  encouraged  either  to  stay 
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silent  or  to  report  wrongdoing  through  unauthorized  channels.  While  some  of  these 
channels  have  been  around  for  hundreds  of  years,  others  are  only  now  emerging  from  the 
new  information-sharing  paradigm  of  the  Internet  and  Web  2.0. 

B,  UNAUTHORIZED  PROCESSES  FOR  WHISTLEBLOWING 

1,  Fourth  Estate 

Traditional  media  organizations  have  played  a  role  in  the  disclosure  of  secret 
information  for  hundreds  of  years.  Politicians  in  British  Parliament  leaked  information  to 
newspapers  for  political  gain  in  the  18th  century  (A  Web  of  English  History,  2009). 
Parliamentary  proceedings  were  off  limits  to  newspapers  prior  to  1770,  and  leaking  was 
used  as  a  tactic  to  force  a  debate  beyond  a  stalemate  or  to  a  re-decision,  through  the 
impact  of  public  opinion,  which  was  primarily  employed  by  calculating  advantage- 
seekers  who  used  the  public  to  influence  internal  power  struggles  (Rosen,  2010).  It  is 
important  to  note  that  this  tactic  was  effective  only  because  of  Parliament’s  efforts  to 
keep  its  proceedings  secret.  By  restricting  public  access  to  all  information,  politicians 
could  leak  small  portions  of  it  that  would  provide  only  one  side  of  the  debate,  usually  that 
which  would  favor  the  side  of  the  party  leaking  the  information.  This  role  of  the  press  in 
government  affairs  was  termed  the  “Fourth  Estate”  by  Edmund  Burke,  comparing  the 
function  of  the  news  media  to  that  of  the  three  houses  then  in  Parliament  (Rosen,  2010). 
The  news  media  has  continued,  since  that  time,  to  play  a  key  role  in  the  leaking  of 
political  information,  and,  up  until  recently,  newspapers  and  other  media  outlets  were 
effectively  the  only  ones  that  could  publish  and  distribute  something  to  a  worldwide 
audience  (Reinventing  the  News  Room,  2010).  The  Pentagon  Papers  and  the  Watergate 
scandal  are  two  examples  of  20th  century  leaks  to  the  news  media  that  significantly 
impacted  U.S.  politics.  However,  the  freedom  of  the  press  to  pursue  investigative 
journalism  and  to  promote  transparency  and  accountability  has  decreased  significantly. 
As  a  result  of  economic  difficulties  faced  by  media  organizations,  pressure  to  compete 
with  the  entertainment  industry,  requirements  for  news  desks  to  be  profitable,  and  the 
increasing  ability  of  the  U.S.  Government  to  influence  news  organizations,  media’s  role 
as  a  U.S.  Government  watchdog  has  declined  significantly  (Eloyd,  n.d.).  In  the  Kansas 
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News  Media,  columnist  Bob  Weeks  writes,  “The  cure  for  a  dishonest  politician  is  an 
investigative  reporter  willing  to  allocate  the  time  to  expose  the  truth.  However,  the 
decline  of  resources  at  newspapers  around  the  nation  has  inereased  the  vacuum  in 
...coverage.  As  such,  newspapers  around  the  eountry  are  curbing  reporters’  ability  to 
spend  the  time  or  money  to  investigate  a  story  in  addition  to  the  daily  beat  they  write” 
(Weeks,  2010). 

In  a  recent  Gallup  poll,  only  34%  of  Americans  believe  that  U.S.  media 
organizations  are  doing  a  good  job  in  fulfilling  their  role  as  a  watchdog  of  the  Obama 
Administration  (Saad,  2010).  With  the  decline  of  investigative  journalism,  media 
organizations  are  then  foreed  to  become  reliant  on  outside  information  sourees — 
whistleblowers  to  provide  the  information  on  whieh  they  can  report.  The  likelihood  that 
whistleblowers  will  choose  to  release  information  to  an  organization  is  dependent  on  two 
primary  conditions,  the  ability  to  maintain  anonymity,  and  the  ability  of  that  organization 
to  publish  the  material  to  a  wide  audienee.  With  traditional  news  media  organizations 
being  pressured  by  the  U.S.  Government  to  release  the  names  of  their  sourees,  anonymity 
can  no  longer  be  guaranteed  (Shenon,  2010;  Egelko,  2006).  Additionally,  with  the  recent 
release  of  information  indicating  that  the  U.S.  Government  successfully  delayed,  for  over 
a  year,  the  publieation  of  information  by  the  New  York  Times  on  warrantless  wiretapping, 
as  well  as  the  increasing  prevalence  of  “pay  walls”  on  news  websites,  the  pereeption  of  a 
traditional  news  organization’s  ability  to  communicate  the  information  to  a  wide 
audience  has  deelined  significantly  (Democracy  Now,  2008;  Rosen,  2010).  Thus,  the 
media  landscape  is  ehanging,  and  traditional  news  organizations  are  no  longer  the  only 
game  in  town.  As  Edmund  Burke’s  ‘Eourth  Estate’  has  seen  its  effectiveness  dwindle,  a 
new  Eifth  Estate  has  been  established  and  it  is  growing  stronger  every  day  (Sam  Adams 
Associates  for  Integrity  in  Intelligence,  2010). 

2,  Fifth  Estate 

In  June  of  2009,  Clay  Shirky  gave  a  talk  at  the  U.S.  State  Department  on  the 
transformation  of  the  media  landscape  and  the  impaet  that  the  new  ‘soeial  media’  has  on 
the  ability  to  exchange  information.  Shirky  discusses  the  redefinition  of  U.S. 
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understanding  of  the  relationship  between  the  media  and  the  publie,  from  a  one-way 
‘producer/consumer’  relationship  to  a  new  paradigm  where  anyone  can  be  a  producer 
(Shirky,  2009).  Traditional  news  media  is  increasingly  finding  itself  on  the  consuming 
end,  identifying  and  reproducing  information  that  they  have  received  from  this  new 
media  paradigm  or  the  Fifth  Estate.  The  Fifth  Estate  consists  of  those  organizations  that 
exist  beyond  the  realm  of  government  control  and  authority,  organizations,  such  as 
Wikileaks.5  Wikileaks  has  been  characterized  as  the  “world’s  first  stateless  news 
organization,”  simultaneously  existing  ‘everywhere,’  bound  by  no  one  country’s  laws  or 
jurisdictions,  and  releasing  information  without  regard  for  any  one  national  interest 
(Reinventing  the  News  Room,  2010;  Twitter;  Wikileaks,  n.d.).  Wikileaks  was  bom  of  the 
Internet,  and  like  the  Internet,  they  have  no  physical  address  or  location  of  which  to 
speak.  Wikileaks  maintains  servers  in  multiple  countries,  has  over  300  Internet  addresses 
registered,  and  relies  heavily  on  the  free  press  laws  of  countries  like  Sweden  and  Iceland 
to  offer  it  legal  protection  from  the  inevitable  ‘legal  and  political  attacks’  from 
governments  and  private  companies  whose  secrets  have  been  exposed  (Assange,  2009). 
The  description  of  what  Wikileaks  is  often  depends  on  where  the  information  is  coming 
from,  and  whether  that  source  supports  or  protests  the  actions  that  Wikileaks  has  taken. 
The  debate  as  to  whether  Wikileaks  is  a  “whistleblower”  organization,  or  a  “treasonous” 
organization,  continues  to  be  fought  on  the  front  pages  of  newspapers,  across  the  Internet, 
and  in  the  public  sphere  worldwide  (Associated  Press,  2010;  Baker,  2010).  While  not  the 
first  and  certainly  not  the  only  website  to  offer  leaked  information  to  the  public 
(Cryptome),  their  innovative  use  of  technology  and  leveraging  the  power  of  the  Internet 
has  catapulted  them  to  the  front  of  the  debate  regarding  secrecy  and  transparency  in  the 
21st  century. 

Wikileaks  is  an  information  clearinghouse,  described  on  its  website  as  a  “not-for- 
profit  media  organization  [whose]  goal  is  to  bring  important  news  and  information  to  the 
public”  (Wikileaks:  About  Us,  n.d.).  It  was  founded  in  December  of  2006  by  a  small 


^  Individuals  with  blogs  also  can  be  included  in  the  definition  of  the  Fifth  Estate. 
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group  of  anti-secrecy  activists  with  the  goal  of  creating  an  “intelligence  agency  of  the 
people”  (Symington,  2009).  While  that  ambitious  goal  has  be  hampered  by  the  many 
controversies  surrounding  Wikileaks  as  an  organization,  over  the  past  four  years,  they 
have  succeeded  in  releasing  over  1 .2  million  documents  to  the  public,  more  than  the  rest 
of  the  world’s  news  media  combined  (Nystedt,  2009;  Assange,  2009).  They  have 
accomplished  this  release  through  their  use  of  information  technology  to  maintain 
sources’  anonymity,  using  “a  convoluted  network  of  Internet  service  providers,  computer 
servers,  hard  drives,  encryption  and  private,  ‘virtual  tunnels’”  (Boyd,  2010).  While  leaks 
in  the  past  have  been  person  to  person  (or  person  to  organization),  the  Wikileaks 
approach  allows  an  anonymous  source  to  provide  information  to  an  anonymous 
organization,  providing  a  never  before  seen  level  of  confidence  in  maintaining  that 
anonymity  (Boyd,  2010).  Jim  Lewis,  the  head  of  the  Technology  and  Public  Policy 
Program  at  the  Center  for  Strategic  and  International  Studies  in  Washington  states,  “with 
the  Pentagon  Papers,  you  had  one  fellow,  Daniel  Ellsberg,  smuggling  paper  out  the 
building  and  giving  it  to  a  reporter.  Today,  in  the  Wikileaks  example,  you  have  some 
unknown  number  of  people  who  are  able  to  contribute  to  a  website  that  thousands,  or 
even  millions  of  people,  can  look  at,  right  now”  (Boyd,  2010)  that  is  a  model  with  which 
traditional  news  organizations  cannot  compete,  and  as  a  result,  they  are  being  forced  to 
redefine  their  role  in  a  “Wikileaks  world”  (Baxter,  2010).  It  is  important  to  note, 
however,  that  Wikileaks  is  constantly  adapting  its  model  to  be  more  effective,  and  part  of 
their  evolution  involves  a  larger  role  for  traditional  media  organizations.  In  an 
environment  increasingly  reliant  on  data,  Wikileaks  has  experienced  difficulty  in 
distinguishing  and  focusing  the  world’s  attention  on  significant  data.  Wikileaks  found 
that  when  they  released  all  of  the  data,  along  with  their  own  commentary,  the  focus  was 
not  on  the  information  itself,  but  on  the  significance  of  Wikileaks  as  an  organization.  Mr. 
Assange  elaborates,  “It’s  counterintuitive,  you’d  think  the  bigger  and  more  important  the 
document  is,  the  more  likely  it  will  be  reported  on  but  that’s  absolutely  not  true.  It’s 
about  supply  and  demand.  Zero  supply  equals  high  demand,  it  has  value.  As  soon  as  we 
release  the  material,  the  supply  goes  to  infinity,  so  the  perceived  value  goes  to  zero” 
(Nystedt,  2009).  Subsequently,  Wikileaks  has  established  an  unofficial  partnership  with 
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traditional  media  organizations,  providing  an  embargo  period  to  inerease  the  exelusivity 
of  the  information  to  a  single  or  a  few  organizations.  Wikileaks’  ability  to  leverage  the 
teehnologieal  eapabilities  of  the  Internet  and  to  adapt  and  evolve  as  eireumstanees 
require,  demonstrates  some  of  the  potential  impaet  that  ‘Fifth  Estate’  organizations  eould 
have  on  the  role  of  traditional  media  organizations  and  the  future  of  information 
dissemination  as  a  whole.  In  faet,  as  a  demonstration  of  the  sueeess  of  the  Wikileaks 
model  for  anonymous  submission,  both  Al-Jazeera  and  The  Wall  Street  Journal 
developed  their  own  online  whistleblower  submission  proeess. 

Wikileaks  is  not  without  its  share  of  eontroversies,  and  both  reasonable  and 
speeulative  eoneerns  have  been  identified  regarding  their  operations.  Immediately  after 
the  first  release  of  information  on  their  website,  Wikileaks  was  attaeked  on  its  eredibility 
(Symington,  2009).  A  few  weeks  later,  John  Young  (the  founder  of  oryptome.org — a 
similar  anti-seoreoy  website)  aooused  Wikileaks  of  being  a  front  for  the  CIA  (Symington, 
2009).  Three  primary  issues  have  oonfronted  Wikileaks,  and  oontinue  to  be  explored  by 
the  U.S.  Government  and  news  organizations:  the  notions  of  Wikileaks  will  damage 
“national  seourity”  (Montalbano,  2010),  they  were  irresponsible  for  not  doing  a  thorough 
review  of  the  information  they  released  (Aftergood,  2010b)  resulting  in  the  release  of  the 
names  of  Afghan  informants,  whioh  plaoed  their  lives  in  danger  (Reals,  2010),  and  that 
their  seoretive  spokesperson  Julian  Assange  has  alternate  agendas  (Assange,  2010)  (and 
his  own  series  of  eontroversies).  Julian  Assange  is  eurrently  fighting  extradition  on 
allegations  of  sex  erimes  in  Sweden,  while  Wikileaks  faees  trouble  of  its  own  (Addley, 
2011). 

Mueh  speeulation  is  foeused  on  the  future  of  Wikileaks,  and  whether  it  will  be 
able  to  oontinue  to  funotion  given  the  tremendous  opposition  moving  against  it  and  the 
personal  issues  oonfronting  Julian  Assange.  Ben  Laurie,  a  member  of  the  Wikileaks 
Advisory  Board  stated,  “Wikileaks  depends  on  the  enthusiasm  of  a  small  number  of 
people,  and  partioularly  on  Assange.  If  he  met  with  a  nasty  aooident,  maybe  Wikileaks 
would  fizzle  out”  (Symington,  2009).  This  situation  does  indeed  seem  to  be  a  likely 
possibility,  partioularly  with  the  reoent  reporting  of  an  internal  dispute  that  has  led  to 
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some  prominent  Wikileaks  staff  members  leaving  the  organization  (Blodget,  2010). 
While  some  might  see  this  as  a  sign  signaling  the  end  of  Wikileaks,  it  is  a  shortsighted 
viewpoint.  The  existence  of  Wikileaks  as  an  organization  is  irrelevant  now,  and  their 
most  significant  contribution  is  not  the  release  of  1.2  million  potentially  classified 
documents.  The  most  significant  impact  of  Wikileaks  is  their  successful  demonstration 
and  validation  of  the  ‘Wikileaks  model.’ 

The  recent  split  may  or  may  not  portend  the  end  of  Wikileaks  as  an  organization; 
however,  it  does  provide  a  glimpse  into  the  future  of  whistleblowing.  In  an  interview  with 
Der  Spiegel  Online,  Daniel  Schmitt,^  the  second  most  senior  member  of  Wikileaks  next 
to  Assange,  talks  about  his  intentions  moving  forward  outside  of  Wikileaks.  He  says,  “I 
will  continue  to  do  my  part  to  ensure  that  the  idea  of  a  decentralized  whistleblower 
platform  stays  afloat.  I  will  work  on  that  now.  And  that,  incidentally,  is  in  line  with  one 
of  our  original  shared  convictions  —  in  the  end,  there  needs  to  be  a  thousand  Wikileaks” 
(Domscheit-Berg,  2010).  Ultimately,  the  destruction  of  Wikileaks  through  the  efforts  of 
governments  and/or  private  organizations  will  not  end  the  leaking  and  proliferation  of 
secrets.  Don  Burke,  the  head  of  the  Central  Intelligence  Agency’s  “Intellipedia”  project, 
has  said  that  in  15  years,  there  will  be  no  more  secrets  (Spaulding,  2010).  Wikileaks  has 
demonstrated  the  ability  to  leak  and  propagate  information  to  a  worldwide  audience,  and 
while  this  might  seem  to  bolster  the  justification  for  the  current  U.S.  policies  and  culture 
of  over-classification,  overloading  the  government  classification  system  actually  weakens 
its  ability  to  protect  the  truly  important  information  (Stewart,  2010).  An  old  saying  from 
1960s  and  1970s  supports  this  premise,  that  “when  everything  is  secret — nothing  is 
secret”  (Agrell,  2002),  and  if  the  United  States  continues  on  its  path  to  try  and  maintain 
the  status  quo  with  regard  to  secrecy  rather  than  adapting,  it  will  find  itself  unprepared 
and  behind  the  curve  when  the  “lights  are  turned  up”  (Spaulding,  2010). 


^  His  real  name  is  Daniel  Domseheit-Berg. 
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3,  Secrecy  and  Over-classification 

The  current  U.S.  policies  governing  the  management  of  classified  information  are 
inadequate  in  the  face  of  the  over-classification  problem  facing  the  U.S.  Government. 
Despite  the  repeated  statements  from  the  current  administration  promoting  increased 
transparency,  including  the  issuance  of  E.O.  13526  and  the  passing  of  the  Reducing 
Over-Classification  Act  by  Congress,  over-classification  remains  a  serious  problem 
facing  the  homeland  security  enterprise  and  the  U.S.  Government  as  a  whole. 

Franklin  D.  Roosevelt  signed  the  first  E.O.  on  Classified  Information  on  March 
22,  1940;  however,  the  debate  on  the  balance  between  secrecy  and  transparency  in  U.S. 
Government  affairs  dates  back  to  Thomas  Jefferson  and  Alexander  Hamilton.  Nineteen 
E.O.  on  Classified  Information  have  been  signed  since  Roosevelt’s  first  E.O.  8381,  the 
most  recent  of  which  is  E.O.  13526  by  President  Obama  in  December  of  2009  (Kosar, 
2010).  Unfortunately,  none  of  the  E.O.s  has  been  able  to  answer  the  question,  how  to 
balance  government  accountability  and  public  need-to-know  against  national  security 
interests? 

Three  components  comprise  the  classification  issue;  initial  classification, 
personnel/policy  implementation,  and  oversight/declassification. 

•  Initial  Classification.  The  current  guidance  on  classification  levels  are 
based  on  long-standing  definitions  of  the  three  primary  markings: 
confidential,  secret,  and  top  secret.  Each  description  is  based  on  the  same 
concept,  that  “the  unauthorized  disclosure  of  [information]  which  could  be 
expected  to  cause  damage  to  the  national  security  that  the  original 
classification  authority  is  able  to  identify  or  describe”  (Office  of  the  White 
House  Press  Secretary,  2009).  Eittle  specificity  exists  regarding  the 
definitions  of  these  key  terms,  and  currently,  the  definitions  used  by  each 
classifier  differs  in  the  implementation  of  this  policy.  National  Security  is 
loosely  defined  as  “the  national  defense  or  foreign  relations  of  the  United 
States”  (Kosar,  2009),  and  no  clear  definitions  exist  that  constitute 
‘damage,’  whether  ‘serious,’  ‘exceptionally  grave’  or  otherwise. 

•  Personnel  and  the  implementation  of  classification  policies, 
accountability,  and  consequences.  The  current  estimate  for  the  total 
number  of  people  holding  security  clearances  is  approximately  2.4  million 
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(Aftergood,  2009).  Each  person  has  a  different  perspective  on 
classification,  varying  levels  of  training,  and  very  little  accountability  in 
terms  of  over-classification. 

•  Oversight,  information  sharing  and  declassification.  Currently  included 
are  the  provisions  regarding  the  duration  of  classification,  internal  review 
processes  for  classified  information,  cross  agency  and  public  information 
sharing.  Public  disputes  regarding  classified  information  (Freedom  of 
Information  Act),  whistleblowers,  both  legitimate  and  illegal  (often 
determined  ex  post  facto),  and  ultimately,  declassification  through  the 
National  Archives  and  Records  Administration.  Presently,  little  oversight 
occurs  of  classification  actions,  FOIA  is  inconsistently  implemented,  and 
Congress  recently  killed  the  Whistleblower  Enhancement  Act. 

While  E.O.  13526  takes  some  steps  towards  increasing  government  transparency 
and  information  sharing  while  decreasing  the  problem  of  over-classification,  it  only 
represents  a  moderate  shift  in  the  traditional  secrecy  vs.  transparency  spectrum.  It  relies 
primarily  on  policy  changes,  and  while  it  hints  at  creating  cultural  change  (“need  to 
know”  vs.  “need  to  share”),  ultimately  its  success  will  be  won  or  lost  based  on  the 
personnel  implementing  it.  For  example,  the  review  of  fundamental  classification 
guidance  is  a  positive  step;  unfortunately,  it  is,  in  many  cases,  being  reviewed  by  the 
same  people  who  implemented  the  incorrect  guidance  in  the  first  place. 

According  to  Clay  Shirky,  the  world  is  currently  experiencing  “the  largest 
increase  in  expressive  capability  in  human  history”  (Shirky,  2009).  Not  only  has  the 
Internet  drastically  improved  the  ability  to  share  information,  it  has  drastically  improved 
the  ability  to  create  information.  With  tools,  such  as  Twitter  (Twitter:  About  Us,  n.d.), 
Facebook  (Facebook:  About  Us,  n.d.),  and  Usahidi  (Ushahidi:  About  Us,  n.d.),  people 
can  send  messages  around  the  world  in  near  real-time  and  provide  firsthand  accounts  of 
actions  and  events  taking  place.  Governments  worldwide  are  rapidly  discovering  that 
their  ability  to  control  information  is  dwindling,  and  Wikileaks  is  but  one  symptom  of  a 
dynamic  change  in  the  world  of  information  as  the  world  knows  it.  For  the  U.S. 
Government  to  protect  its  secrets,  it  requires  a  dramatic  change  in  policy  and  approach: 
an  acknowledgement  that  embarrassing  secrets  and  proof  of  wrongdoing  does  not  equate 
to  ‘national  security,’  that  current  government  methods,  such  as  Offices  of  the  IG,  the 
GAO  and  the  Whistleblower  Protection  Act,  do  not  equal  an  effective  means  to  maintain 
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transparency,  and  an  acknowledgement  that  the  media  environment  has  compensated,  and 
is,  as  a  whole,  beyond  government  influence.  It  is  unrealistic  to  think  that  everything  can 
be  declassified,  and  both  sides  of  the  debate  acknowledge  that  legitimate  topics  (e.g., 
nuclear  weapons  design)  should  be  kept  out  of  the  public  domain. 

E.O.  13526  is  only  in  its  first  year  of  execution  and  it  is  premature  to  say  whether 
these  steps  alone  will  be  effective.  However,  technology  has  changed  the  paradigm  in 
which  the  world  communicates  and  U.S.  Government  policies  on  classification  and 
information  sharing  require  a  significant  update.  In  light  of  the  fact  that  leaks  will  likely 
increase  over  the  coming  years  and  secrets  will  become  harder  to  maintain,  the  U.S. 
Government  should  support  and  expand  upon  the  goals  of  E.O.  13526  and  reduce  its 
overall  classified  footprint,  with  a  view  towards  restoring  public  trust.  Achieving  both 
these  goals  will  ultimately  contribute  to  the  safety  and  security  of  the  homeland. 

4,  Public  Trust 

Despite  the  commonly  accepted  and  promoted  concept  of  the  importance  of 
public  involvement  in  government  affairs,  and  the  efforts  of  agencies,  such  as  the  DHS  to 
increase  public  engagement,  public  trust  has  declined  significantly  during  the  past 
decade.  A  2005  Harris  poll  determined  that  among  Americans,  only  27%  trust  the 
government  (Covey,  2006),  and  according  to  the  PEW  Research  Center,  with  the 
exception  of  a  significant  dip  in  November  of  2001,  distrust  and  anger  towards  the 
government  has  been  rising  to  86%  as  of  April  of  2011  (Pew  Research  Center,  2011). 
With  regard  to  whistleblowing  and  transparency,  the  actions  of  the  Obama  and  Bush 
administrations  have  only  served  to  increase  public  (and  whistleblower)  distrust.  The 
EBEs  pursuit  of  whistleblowers  prompted  Senators  Grassley  and  Eeahy  to  send  a  letter  to 
EBI  director  Mueller  identifying  a  “concern... that  the  latest  investigation  was  a  sign  of 
the  EBEs  apparent  haste  to  launch  an  OPR  probe  every  time  an  agent  speaks  publicly 
about  problems  within  the  FBI”  (Grassley,  2004).  Significant  concerns  were  raised  with 
the  appointment  of  Scott  Bloch  to  the  OSC,  which,  in  a  2004  GAO  report,  indicated  that 
the  OSC  only  met  its  statutory  timelines  26%  of  the  time  and  that  95-97%  of  its 
whistleblower  cases  were  backlogged  (Project  on  Government  Oversight,  2005). 
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Additionally,  Bloch  was  placed  under  investigation  for  alleged  retaliation  against 
employees;  diserimination  based  on  sexual  orientation,  and  on  April  27,  2010,  pleaded 
guilty  to  criminal  contempt  of  Congress  and  is  faeing  jail  time  (Hsu,  2011).  Creating  a 
eireumstanee  on  whieh  the  head  of  the  organization  responsible  for  investigating 
retaliation  on  behalf  of  whistleblowers,  is  in  fact,  conducting  retaliatory  practiees  himself, 
eombined  with  the  Obama  Administration’s  unparalleled  prosecution  of  whistleblowers 
(signifieantly  more  than  any  previous  administration  (Greenwald,  2010)),  has  damaged 
publie  pereeption  and  trust  in  the  government  proeess. 

When  it  eomes  to  whistleblowing,  trust  is  one  of  the  most  important  faetors, 
whieh  guides  the  aetivity.  In  a  MSPB  study,  three  of  the  top  four  reasons  why 
whistleblowers  did  not  eome  forward  had  to  do  with  fear  of  retaliation  (Projeet  on 
Government  Oversight,  2005).  However,  trust  as  it  has  been  traditionally  defined 
(Giddens,  1990),^  does  not  really  eapture  the  signifieanee  of  trust  in  this  eontext.  When  it 
eomes  to  the  relationship  between  whistleblowers  and  the  government,  Rashid  and 
Edmondson’s  definition  of  ‘risky  trust’  is  more  applicable  (Rashid,  2011).^  It  is  important 
to  aeknowledge  whistleblowers’  eareers,  reputations,  and  livelihoods  are  often  at  stake.  If 
whistleblowers  do  not  trust  the  government  to  act  with  their  best  interest  in  mind,  they 
will  eontinue  to  either  stay  silent,  or  report  wrongdoing  through  unauthorized  ehannels 
that  do  not  have  the  same  high  level  of  personal  risk  assoeiated  with  it. 

5.  Trust  and  Third  Parties 

The  use  of  a  third  party  to  overeome  trust  issues  in  otherwise  dyadie  relationships 
are  already  eommonly  used  in  the  areas  of  E-eommeree,  mediation,  seeure 
eommunieations  and  online  transaetions  (Blaze,  1996;  Eranklin,  1997).  In  Building 
Consumer  Trust  Online,  Hoffman,  Novak  and  Peralta  state,  “in  the  near  term,  this  [laek 
of  trust]  eannot  be  easily  resolved,  but  we  ean  address  it  by  giving  eonsumers  the 

^  A  person’s  confidence  in  the  reliability  of  another  person  with  respect  to  certain  outcomes. 

^  Risky  trust  exists  when  the  magnitude  of  risk  is  significantly  objectively  higher  than  in  most  work  or 
life  settings. 
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opportunity  to  be  anonymous  or  pseudonymous  when  engaging  in  information  exchanges 
and  online  transactions,”  and  that  the  goal  is  to  provide  “traceable  anonymity,”  which 
“gives  Web  providers  no  clues  about  consumers’  identities  but  leaves  this  information  in 
the  hands  of  a  third  party”  (Hoffman,  1999).  Leveraging  the  use  of  third  parties  to 
promote  government  accountability  is  not  a  new  concept,  and  can  be  seen  in  the  use  of 
semi-independent  investigation  organizations  (IG,  and  GAO,  the  ‘watchdog’  role  of 
media  as  the  Fourth  Estate,  and  in  the  whistleblowing  arena  through  the  UK’s  three-tiered 
policy  for  whistleblower  submissions,  which  uses  a  ‘proxy  for  society’  as  its  second  tier 
(Lewis,  2010). 

Previous  attempts  have  actually  be  made  by  the  government  to  leverage 
technology  and  anonymity  to  promote  whistleblower  activities,  specifically,  with  the 
GAO’s  FRAUDNET  (Government  Accountability  Office,  2009)  and  the  DoD’s  ‘Defense 
Hotline’  (Department  of  Defense  Inspector  General,  2007),  which  all  seem  to  support  the 
concept  of  “horizontal  accountability”  as  described  by  Mark  Bovens. 

Partly  in  reaction  to  a  perceived  lack  of  trust  in  government,  there  is  an 
urge  in  many  western  democracies  for  more  direct  and  explicit 
accountability  relations  between  public  agencies  on  the  one  hand  and 
clients,  citizens  and  civil  society,  including  the  media,  on  the  other  hand. 

The  latter  should  become  forums  of  political  accountability,  so  the 
argument  goes,  and  agencies  or  individual  public  managers  should  feel 
obliged  to  account  for  their  performance  to  the  public  at  large  or  to  civil 
interest  groups,  charities,  and  associations  of  clients.  This  would  be 
horizontal  accountability  in  the  true  sense,  as  the  complete  hierarchical 
chain,  including  Parliament,  is  surpassed  and  the  agency,  the  minister,  or 
the  public  manager  is  directly  accountable  to  the  citizenry.  (Bovens,  2005) 

The  identification  of  the  appropriate  entity  to  function  as  the  third  party  in  this 
matter  is  critical.  It  could  be  argued  that  the  government  currently  uses  third  parties 
already  with  regard  to  whistleblowers  (through  the  use  of  IGs,  GAO,  and  the  OSC), 
however,  in  addition  to  the  issues  discussed  above,  all  these  organizations  share  the  same 
flaw  in  that  they  are  government  bodies,  funded  through  government  channels  and  whose 
leadership  is  often  politically  appointed  (Project  on  Government  Oversight,  2002). 
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Whether  this  aetually  creates  conflicts  of  interest  or  just  the  perception  of  them,  they 
currently  do  not  have  the  ability  to  serve  as  a  facilitating  third  party  and  increase  trust 
amongst  the  public. 

6,  Realities  of  Anonymous  Reporting 

The  solution  proposed  by  this  thesis  relies  on  the  concept  of  anonymity  to 
increase  the  likelihood  of  reporting.  The  concept  of  anonymity  in  whistleblowing  is  not 
new,  nor  is  the  implementation  of  solutions  based  on  anonymity  novel  in  government. 
The  development  and  promotion  of  ‘hotlines’  in  government  were  established  with  the 
passage  of  the  Inspectors  General  Act  of  1978  (Johnson,  2003).  Since  that  time,  the 
number  of  hotlines  has  significantly  increased,  as  has  their  use.  In  1989,  the  DoD  Hotline 
received  12,000  calls  per  year,  increasing,  to  14,000  in  1992,  and  by  1997,  the  DoD 
hotline  received  8,220  calls  in  six  months.  In  1997,  the  DoD  Inspector  General  claimed 
that,  since  its  inception,  the  hotline  had  saved  the  government  over  $391  million 
(Johnson,  2003).  The  DoD  Hotline  and  the  Inspector  General’s  FraudNET  program  have 
even  expanded  to  allow  for  ‘anonymous’  submissions  through  the  Internet.  However, 
significant  concerns  have  been  raised  regarding  the  effectiveness  and  protections 
provided  by  hotlines.  According  to  a  report  released  by  the  Government  Accountability 
Project  in  1997,  hotlines  have  “an  abysmal  track  record  in  terms  of  investigation  of 
allegations,  substantiation  of  charges,  and  corrective  action”  (Miethe,  1999).  In  The  Art  of 
Anonymous  Whistleblowings  the  authors  recount  the  story  of  a  Chief  Petty  Officer  who 
used  the  DoD  Hotline  to  submit  an  anonymous  report.  The  next  morning  he  was  called 
into  his  security  officer’s  conference  room  and  told  a  call  had  been  received  informing 
him  that  someone  had  tried  to  contact  the  IG.  The  security  officer  directed  the  Chief  Petty 
Officer  to  “find  the  caller  and  plug  the  leak”  (Project  on  Government  Oversight,  2002). 
Stories  like  this  highlight  the  problems  associated  with  hotline  use,  including  the  inherent 
conflicts  of  interest  of  hotlines,  which  fall  under  the  same  organization  as  the  reporting 
employee.  When  an  administrative  contracting  officer  for  the  Defense  Logistics  Agency 
tried  to  blow  the  whistle  on  her  agency,  she  turned  to  the  DoD  Hotline  after  a  number  of 
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unsuccessful  attempts  to  get  her  organization’s  management  to  investigate.  The  DoD 
Hotline  referred  the  ease  baek  to  her  management  for  investigation,  who  elosed  the  case 
as  “unsubstantiated”  (Johnson,  2003). 

Signifieant  eoncerns  regarding  eonfidentiality  and  anonymity  provided  by 
hotlines  have  been  raised.  While  hotlines  often  provide  elaims  of  anonymity,  they  offer 
little  or  no  proteetions  other  than  the  assurances  granted  through  their  privaey  polieies. 
Potential  whistleblowers  often  do  not  understand  the  risks  assoeiated  with 
eommunieating  with  hotlines,  either  trusting  hotlines  to  strip  out  personally  identifiable 
information,  or  assuming  proteetions  by  ealling,  emailing,  or  submitting  complaints  via 
the  Internet  (see  seetion  on  teehnology  evaluation).  This  eoneem  is  so  signifieant,  that 
The  Whistleblower’s  Handbook  goes  as  far  to  say,  “don’t  blindly  trust  eorporate- 
sponsored  hotlines”  (Kohn,  2011).  The  eoneerns  regarding  eonfidentiality  and  anonymity 
expand  beyond  eorporate/govemment  sponsored  hotlines.  Following  the  sueeess  of  the 
Wikileaks  model  for  anonymous  submission,  both  Al-Jazeera  and  The  Wall  Street 
Journal  developed  their  own  online  whistleblower  submission  proeess.  Shortly  after  their 
implementation,  internet  seeurity  experts  panned  both  organizations  (ineluding  a 
Wikileaks  volunteer)  and  the  Eleetronie  Frontier  Foundation  (EFF)  for  promoting  “false 
promises  of  anonymity”  (Fakhoury,  2011).  The  general  eonsensus  of  whistleblowing 
advoeates  is  that  hotlines  have  the  potential  to  be  useful,  but  signifieant  risks  are 
assoeiated  with  their  use.  The  EFF  eoneludes  their  analysis  of  The  Wall  Street  Journal 
and  Al-Jazeera’s  submission  sites  by  stating  “these  websites  are  misleading  and... use  of 
them  by  people  who  risk  proseeution  or  retaliation  for  bringing  sunshine  to  eorruption, 
illegal  behavior,  or  other  topics  worthy  of  whistleblowing,  is  risky  at  best  and  dangerous 
at  worst”  (Fakhoury,  2011). 

Over  the  past  deeade,  an  inereasing  number  of  whistleblowers  have  eome 
forward,  and  despite  the  risks  assoeiated  with  their  diselosures,  many  of  them  began  by 
reporting  wrongdoing  within  the  authorized  proeess.  In  some  of  those  eases,  it  was  only 
after  they  were  unsueeessful  in  affecting  change  that  they  ehose  to  seek  assistanee 
through  unauthorized  proeesses  (the  Fourth  or  Fifth  Estate).  Both  the  eases  of  Thomas 
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Drake  and  the  recent  issues  with  the  Bureau  of  Alcohol  Tobacco  and  Firearms  ‘Fast  and 
Furious’  program  began  as  internal  disclosures  that  did  not  result  in  action.  Thomas 
Drake  was  a  National  Security  Agency  (NSA)  employee  who  raised  questions  about  the 
efficiency  and  effectiveness  of  some  post-9/11  NSA  programs  to  his  management.  After 
being  dismissed,  he  submitted  a  report  to  the  DoD  IG’s  office  on  what  he  reasonably 
believed  was  organizational  wrongdoing  by  the  NSA  (including  its  telecommunications 
collection  program).  His  next  step  was  to  inform  Congress  of  the  issues,  and  only  after  he 
had  exhausted  his  authorized  options,  did  he  then  decide  to  disclose  the  wrongdoing  to 
the  Baltimore  Sun.  He  was  tried  under  the  Espionage  Act,  much  like  Daniel  Ellsberg  of 
the  Pentagon  Papers',  however,  all  charges  against  him  were  dropped  in  return  for  his 
guilty  plea  against  the  lesser  misdemeanor  charge  of  misusing  the  agency’s  computer 
system.  Drake  lost  his  job  and  his  pension  and  now  works  at  an  Apple  store  (Zetter, 
2010). 

ATE  Agent  John  Dodson  had  questioned  his  supervisors  over  the  ‘Operation  East 
and  Eurious,’  an  ATE  program,  which,  in  an  attempt  to  shut  down  weapons  trafficking 
networks,  allowed  Mexican  drug  cartels  to  purchase  weapons  from  U.S.  arms  dealers. 
Dodson’s  management  quickly  reassigned  him  to  another  job,  while  taking  no  action  to 
stop  or  modify  the  program,  hollowing  the  death  of  U.S.  Border  Patrol  Agent  Brian  Terry 
(by  weapons  purchased  through  the  ‘East  and  Eurious’  program),  Dodson  submitted  a 
complaint  to  the  ATE  Office  of  Chief  Counsel  and  Ethics  section  of  the  Office  of  the  IG. 
While  little  action  on  the  part  of  ATE  leadership  was  taken,  he  was  contacted  by 
Congress,  which  proceeded  to  conduct  an  in-depth  investigation.  Six  other  agents  came 
forward  to  support  Dodson’s  report  on  the  ATE  program.  Dodson  and  three  other  agents 
were  transferred  to  other  offices,  one  agent  retired,  and  the  other  agents  involved  with 
this  issue  have  requested  investigations  into  agency  retaliation  (Eajeunesse,  2011). 

These  stories  support  the  information  identified  above,  and  serve  as  examples  of 
how  current  processes  for  authorized  submissions  fall  short  of  providing  adequate 
whistleblower  protections  and  often  do  not  result  in  the  redress  of  organizational 
wrongdoing.  In  the  absence  of  action  in  the  authorized  process,  whistleblowers  turn  to 
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unauthorized  processes  to  achieve  their  goals.  The  over-classification  problem  inherent  in 
government  only  serves  to  encourage  whistleblowers  to  make  disclosures,  and  the  lack  of 
public  trust  in  the  authorized  system  causes  them  to  seek  unauthorized  methods  for 
disclosure.  However,  unauthorized  processes  also  fail  to  provide  whistleblower 
protection,  and  can  result  in  the  exposure  of  truly  sensitive  information  that  should  be 
restricted  for  reasons  of  national  security. 

C.  TECHNOLOGY  EVALUATION 

1.  Current  Technologies/Background 

To  develop  potential  solutions,  the  vulnerabilities  of  current  technologies 
available  for  anonymous  submission  must  be  identified.  Three  primary  means  exist  for  a 
whistleblower  to  submit  information  to  the  government:  over  the  phone,  through  email, 
or  through  the  use  of  a  web  browser.  While  the  phone  can  provide  some  anonymity  and 
information  security  through  the  use  of  pay-as-you-go/disposable  cell  phones,  major 
concerns  are  associated  with  discovery  through  other  means  (e.g.,  the  purchase  of  the 
phone  in  the  first  place,  voice  recognition,  the  location  associated  with  the  origination  of 
the  call,  etc.).  These  factors,  combined  with  the  inherent  transmission  limitations 
associated  with  using  a  phone  (only  verbal  submissions,  no  documents,  etc.),  make  the 
use  of  phones  a  possibility,  albeit  an  unlikely  solution,  to  this  problem. 

The  systems  associated  with  electronic  communications  are  divided  up  into  two 
categories,  high-latency  systems  and  low-latency  systems.  High-latency  systems  can 
experience  and  tolerate  high  delays  in  the  transmission  of  information,  and  are  generally 
used  in  non-interactive  or  non-real-time  applications,  such  as  email.  Low-latency  systems 
generally  do  not  experience  and  have  low  tolerance  for  delay  in  the  transmission  of 
information,  and  are  intended  for  use  in  real-time  applications,  such  as  web  browsing, 
instant  messaging,  and  VOIP  (Mayer,  2009). 

a.  High-Latency  Systems 

Solutions  for  high-latency  systems  are  able  to  provide  some  of  the  best 

anonymity  available.  Using  technologies  known  as  anonymous  remailers,  it  would  be 
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possible  for  a  whistleblower  to  submit  information  over  email  to  the  U.S.  Government 
with  strong  anonymity  proteetions.  Anonymous  remailers  essentially  serve  as  a 
middleman,  forwarding  the  eontents  of  the  email  to  the  reeipient  without  the  reeipient 
reeeiving  knowledge  on  the  original  sender’s  identity.  In  their  2009  paper,  “On 
Anonymity  in  an  Eleetronic  Soeiety:  A  Survey  of  Anonymous  Communication  Systems,” 
Matthew  Edman  and  Bulent  Yenner  from  Rensselaer  Polytechnic  Institute  provide  an 
excellent  description  of  the  process. 

Imagine  Alice  is  a  corporate  whistleblower  who  wants  to  mail  a  letter  to 
The  New  York  Times  revealing  some  misconduct,  but  still  wants  to  remain 
anonymous  for  fear  of  losing  her  job.  Similarly  to  how  IP  addresses  can 
reveal  who  sent  a  particular  packet,  simply  writing  a  letter  and  dropping  it 
in  the  local  post  office  box  would  leak  information  to  the  recipient  about 
where  the  message  originated  because  of  the  postal  markings  on  the 
envelope.  Instead,  Alice  places  the  envelope  addressed  to  The  New  York 
Times  inside  another  envelope  addressed  to  a  third  party  named  Charlie. 

This  outer  envelope  is  then  placed  inside  yet  another  envelope  addressed 
to  another  person,  Sam.  Alice  then  places  the  multiply  enveloped  letter 
into  her  local  post  office  box.  When  Sam  receives  the  envelope,  he  opens 
it  and  finds  another  envelope  addressed  to  Charlie.  Recognizing  the 
envelope  is  not  addressed  to  him,  Sam  then  drops  it  in  his  local  post  office 
box.  Similarly,  when  Charlie  receives  and  opens  the  envelope  addressed  to 
him,  he  finds  another  addressed  to  The  New  York  Times,  which  he  then 
also  forwards.  Since  the  envelope  received  at  The  New  York  Times  came 
from  Charlie’s  post  office,  it  does  not  give  away  any  information  about 
Alice’s  location.  The  envelope  received  by  Sam  can  be  used  to  identify 
Alice,  but  Sam  only  knows  the  next  hop  in  the  path  and  not  the  letter’s 
content  or  its  intended  destination.  Only  if  all  people  in  the  letter’s  path 
collaborate  can  they  identify  Alice  as  the  sender  of  the  letter  received  by 
the  newspaper. 

Remailers  also  provide  added  security  in  that  not  only  do  they  forward  the 
information,  often  times  it  will  be  mixed  with  other  messages,  placed  in  batches,  and 
forwarded  as  a  means  to  guard  against  unwanted  observers.  Three  primary  types  of 
anonymous  remailers  exist:  Type  I  or  cypherpunk  remailers;  Type  II  or  Mixmaster 
remailers;  and  Type  III  or  Mixminion  remailers  (Remailers).  Of  the  three,  Mixminion 
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(Mixminion:  A  Type  III  Anonymous  Remailer,  n.d.)  is  the  most  advaneed  remailer 
available  and  ean  be  used  free  of  charge,  unfortunately,  however,  it  requires  a  level  of 
computer  savvy  that  the  average  government  employee  may  not  possess. 

The  use  of  email  provides  one  of  the  best  solutions  from  an  anonymity 
perspective,  although,  it  leaves  much  to  be  desired  in  terms  of  reliability  and  information 
security.  Anonymous  remailers  are  vulnerable  to  numerous  types  of  attacks,  suffer  from 
unreliability  concerning  delivery,  have  significant  issues  associated  with  recipient  replies, 
and  have  the  potential  to  compromise  the  security  of  the  information  being  transmitted. 
Email  exists  as  a  potential  solution  for  the  submission  of  non-sensitive  unclassified 
information;  however,  a  more  robust  solution  is  required  to  include  additional  measures, 
which  ensure  information  security  and  address  the  whistleblowers’  need  for  feedback. 

b.  Low-Latency  Systems 

The  processes  associated  with  high-latency  anonymity  solutions  can  create 
delays  of  many  hours  and  even  days  prior  to  the  completion  of  the  transmission,  a 
solution,  which  does  not  work  in  the  low-latency  environment  of  the  web.  However,  the 
overarching  concept  associated  with  low-latency  anonymity  solutions  is  very  similar  to 
the  one  described  in  the  Alice  and  The  New  York  Times  example  above.  The  submitter 
(Alice  in  that  case)  could,  through  the  use  of  one  of  the  following  three  types  of 
anonymity  solutions;  hide  their  IP  address  and  location  from  the  recipient  {The  New  York 
Times).  The  three  categories  of  low-latency  system  solutions  are  as  follows:  Proxy 
Servers,  Virtual  Private  Networks  (VPNs)  and  Onion  Routing. 

(1)  Proxy  Servers.  Proxy  servers  are  essentially  a  forwarding 
service  (Sam,  from  the  previously  cited  example),  who,  unlike  the  remailers  described 
above,  do  not  manipulate  the  data  in  any  way  prior  to  forwarding.  A  proxy  server  would 
allow  the  sender  to  submit  data  through  a  third-party  network  in  a  manner  in  which  only 
the  fact  that  the  information  came  from  a  third  party  is  discernible  to  the  recipient.  Basic 
web-proxy  services,  such  as  Anonwatch  (AnonWatch,  n.d.),  are  weak  on  both  anonymity 
and  information  security;  however,  the  proxy  concept  has  spawned  two  additional 
solutions  in  the  form  of  VPNs  and  Onion  Routing. 
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Figure  1.  Information  Flow  Through  a  Proxy  Server  (From;  Public  Proxy  Servers, 
n.d.) 


(2)  Virtual  Private  Networks.  VPNs  are  currently  used  by  the 
government  and  other  organizations  as  the  means  through  which  an  offsite  employee  can 
access  its  organizations’  network  resources  by  creating  a  secure  tunnel  between  the 
organization’s  servers  and  the  end  user. 
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Figure  2.  Using  a  Virtual  Private  Network  (From;  Hide  Your  IP  Address  with  a  VPN, 

2011) 


Relevant  to  the  whistleblowing  submission  process,  VPNs  provide 
a  paid  for  proxy  server  with  end-to-end  encryption,  through  which  the  sender  would 


submit  information  to  the  government  through  the  network  provided  by  the  third-party 
VPN  provider,  maintaining  anonymity  from  the  government.  Signifieant  issues  are 
assoeiated  with  the  use  of  VPN  teehnology  for  whistleblowing  eoncerning  both 
anonymity  and  information  seeurity.  Regarding  anonymity,  while  the  use  of  VPN 
software  allows  the  sender  to  hide  his  identity  from  the  reeipient,  it  does  NOT  hide  his 
identity  from  the  third-party  VPN  provider.  The  possibility  exists  that  the  government 
eould  subpoena  or  pressure  the  VPN  provider  to  provide  its  logs,  payment  history,  and/or 
other  information  that  eould  eompromise  the  identity  of  the  sender. 

VPNs  also  pose  a  potential  problem  in  terms  of  information 
security;  while  a  VPN  does  provide  significant  protection  from  the  snooping  of  outside 
parties,  the  company  itself  would  have  potential  access  to  the  information  being 
forwarded.  The  use  of  end-to-end  encryption  reduces  this  possibility  significantly,  but  it 
is  understandable  that  the  government  would  be  reluctant  to  provide  a  third-party 
company  (many  in  foreign  countries)  access  to  sensitive  information.  Many  pay-for- 
service  VPNs  are  available  currently,  including  StrongVPN  (StrongVPN,  n.d.),  ViprVPN 
(GoldenFrog,  n.d.),  WiTopia  (WiTopia,  20102),  Anonymizer  (Anonymizer,  n.d.),  and 
Xerobank  (xerobank,  2012). 

(3)  Onion  Routing.  The  approach  used  by  onion  routing  is 
different  from  that  of  a  VPN  in  that  instead  of  one  layer  of  anonymity  protection  (the 
VPN  provider);  multiple  layers  of  anonymity  protection  exist  (as  described  by  Alice  and 
The  New  York  Times  example  above).  The  most  prevalent  onion  routing  system  available. 
The  Onion  Router  or  TOR  (Tor,  n.d.a),  was  actually  developed  by  the  Navy  (Onion 
Routing,  n.d.)  to  provide  anonymity  and  security  in  its  communications.  It  was  made 
public  when  it  realized  that  if  only  the  Navy  was  using  the  system,  the  anonymity  set  was 
1,  and  therefore,  it  could  not  use  it  anonymously.  Only  when  the  user  base  of  the  system 
increased  would  the  system  achieve  its  goals.  Instead  of  the  single  path  identified  by  the 
VPN  server,  TOR  selects  random  paths  of  three  nodes  from  thousands  of  possible  nodes, 
providing  anonymity  for  the  sender. 
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Step  2:  Alice’s  Tor  client 
picks  a  random  path  to 
destination  server.  Green 
links  are  encrypted,  red 
links  are  in  the  clear. 


Jane 


7^ 

1  Tor  nodo 

.  .  unoncryptod  link 

a 

■ 

a 

»  oncryptod  link 

3^ 

Bob 


Figure  3.  Accessing  the  Internet  via  TOR  (From:  Randomwire,  2011). 


In  terms  of  its  potential  for  use  in  the  whistleblowing  process,  TOR 
provides  great  anonymity  for  a  single  use  submission,  and  with  the  use  of  end-to-end 
encryption  (such  as  TLS/SSL),  it  also  provides  significant  information  security.  Concern 
still  exists  from  the  government’s  perspective  regarding  sensitive  information  traveling 
through  unknown  nodes  (even  while  encrypted).  TOR  is  not  the  only  solution  available 
for  the  Onion  Routing  approach,  Jondonym  (JonDonym,  (n.d.)  and  I2P  (I2P,  n.d.)  are 
other  paid  solutions  that  claim  to  address  some  of  the  concerns  associated  with  TOR’s 
vulnerabilities  and  add  some  user-friendly  applications. 

c.  Vulnerabilities 

Many  vulnerabilities  are  associated  with  the  use  of  these  technologies, 
including  Traffic/Trend  analysis  (Hermann,  2009),  Man-in-the-Middle  (MITM)  attacks 
(Zusman,  2009),  Denial  of  Service  (DOS)  attacks,  as  well  as  identification  vulnerabilities 
associated  with  cookies,  JavaScript,  flash,  and  other  plug-ins  that  could  bypass  any 
system  (VPN  or  Onion  Router)  and  reveal  the  sender’s  identity  (Clark,  2010).  Concerns 
also  exist  regarding  the  use  of  public  computers  (for  both  anonymity  and  information 
security),  the  possibility  of  key  loggers  and  malware  compromising  the  senders’  system, 
and  the  issues  associated  with  anonymous  payment  for  services  (private  VPNs, 
Jondonym,  etc.).  The  research  on  vulnerabilities  is  extensive,  with  both  the  academic 
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community  and  hacker  community  very  aetive  in  pursuing  both  vulnerabilities  and 
solutions.  Over  40  publieations  exist  on  electronie  anonymity,  going  baek  as  far  as  1981 
on  Freehaven.net,  whieh  provides  in-depth  detail  on  the  issues  identified  above. 
However,  for  the  whistleblowing  environment,  the  researcher  believes  one  or  more 
teehnological  solutions  can  be  applied  to  provide  protections  through  anonymity. 

D,  FINDINGS 

The  eonelusions  in  this  thesis  eould  each  be  debated  and  explored  in  extraordinary 
detail  as  thesis  topics  in  their  own  right.  However,  based  on  the  research  and  analysis 
conducted  above,  the  researeher  has  ehosen  to  aeeept  the  following  premises  as  true,  and 
proeeeds  to  foeus  on  the  solution  to  the  defined  problem. 

•  Overelassifieation  is  a  problem 

•  Information  sharing  is  eritieal  to  both  U.S.  seeurity  and  U.S  demoeraey 

•  Homeland  seeurity  efforts  require  publie  (to  inelude  its  employees  and 

partners)  trust  and  support  to  succeed 

•  The  ability  to  keep  seerets  and  maintain  eontrol  of  elassified  information 
will  eontinue  to  deerease 

•  Deereasing  overelassifieation  will  save  the  United  States  money 

•  Whistleblowing  is  a  eivie  duty 

•  The  government  is  eommitted  to  providing  whistleblower  protections 

•  Whistleblowers  are  in  large  part  motivated  by  patriotism 

•  Anonymity  is  a  positive  ineentive  for  whistleblowers 

•  Fourth  and  Fifth  Estates  provide  alternatives  to  the  government  proeess 

•  Publie  trust  in  the  government  has  deelined 

•  Publie  trust  ean  be  inereased  through  the  use  of  third  parties 

•  Teehnology  exists  to  provide  anonymity  to  whistleblowers 

•  Current  options  for  whistleblowing  are  inadequate 

These  premises  are  important  to  understand  prior  to  the  identifieation  and 
evaluation  of  potential  solutions,  as  they  form  the  foundation  and  justifieation  for  the 
implementation  of  any  solution. 
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•  Over-classification  is  a  problem.  The  U.S.  Government  has  repeatedly 
and  openly  acknowledged  the  problem  of  over-classification.  In  a 
statement  by  the  Director  of  the  Information  Security  Oversight  Office,  J. 
William  Leonard,  to  the  U.S.  House  of  Representative’s  Committee  on 
Government  Reform,  he  plainly  stated  “it  is  no  secret  that  the  [US] 
Government  classifies  too  much  information”  (Devine,  2011).  At  his 
confirmation  hearing,  the  Director  of  National  Intelligence,  James  R. 
Clapper  stated,  “We  do  over-classify.  We  can  be  a  lot  more  liberal,  I  think, 
about  declassifying,  and  we  should  be.”  Even  President  Barack  Obama 
publicly  acknowledged,  “effective  measures  to  address  the  problem  of 
over-classification”  (Aftergood,  2010a)  are  needed.  What  has  not  as  yet 
been  clearly  defined  and  acknowledged  is  an  understanding  of  the  effects 
of  over-classification,  including  its  contribution  to  the  unauthorized 
disclosure  of  information. 

•  Information  sharing  is  critical  to  both  U.S.  security  and  U.S. 
democracy.  Over-classification  leads  to  a  degradation  in  U.S.  ability  to 
engage  effectively  in  homeland  security  efforts  by  reducing  the  flow  of 
critical  information  across  agencies  and  levels  of  government. 
Additionally,  transparency  through  public  information  sharing  is  a  critical 
component  of  U.S.  democracy.  Excessive  government  secrecy  and  over¬ 
classification  has  reduced  government  accountability  by  obstructing  the 
public’s  ability  to  seek  disclosure  of  government-held  information  (The 
Constitution  Project’s  Eiberty  and  Security  Committee,  2009).  An 
informed  public  is  necessary  to  ensure  that  the  U.S.  Government  is  acting 
appropriately  and  in  the  best  interests  of  the  people  for  whom  it  purports 
to  work. 

•  Homeland  security  efforts  require  public  trust  and  support  to 
succeed.  The  homeland  security  enterprise  is  comprised  of  entities  from 
all  disciplines  and  levels  of  government,  including  the  public.  Prom 
suspicious  activity  reporting  and  contributing  to  the  deterrence  of  terrorist 
activities,  to  leveraging  public  preparedness  to  empower  communities, 
help  minimize  fear,  and  diminish  the  effectiveness  of  terrorist  tactics,  the 
public  plays  a  key  role  in  homeland  security  efforts  (U.S.  Department  of 
Homeland  Security,  2010).  The  Final  Report  of  the  National  Commission 
on  Terrorist  Attacks  Upon  the  United  States  (9/11  Commission  Report) 
found  that  existing  trends  of  over-classification  deprived  intelligence  and 
law  enforcement  of  a  potent  weapon  against  terrorism:  an  alert  and  well- 
informed  American  public  (National  Commision  On  Terrorist  Attacks 
Upon  The  United  States,  2004).  Over-classification  and  the  accompanying 
lack  of  transparency  may  have  eroded  public  trust  in  the  government, 
resulting  in  a  decrease  in  security  as  well.  Additionally,  decreased  trust  in 
government  activities  may  result  in  additional  leaks  of  classified 
information. 


62 


•  The  ability  to  keep  secrets  and  maintain  control  of  classified 
information  will  continue  to  decrease.  Don  Burke,  the  head  of  the 
Central  Intelligenee  Ageney’s  “Intellipedia”  project,  has  said  that  in  15 
years,  there  will  be  no  more  secrets  (Spaulding,  2010).  Wikileaks  has 
demonstrated  the  ability  to  leak  and  propagate  information  to  a  worldwide 
audience,  and  while  this  might  seem  to  bolster  the  justification  for  the 
current  U.S.  policies  and  culture  of  over-classification,  overloading  the 
government  classification  system  actually  weakens  its  ability  to  protect  the 
truly  important  information  (Stewart,  2010).  An  old  saying  from  the  1960s 
and  1970s  supports  this  premise,  that  “when  everything  is  secret — nothing 
is  secret”  (Agrell,  2002).  If  the  United  States  continues  on  its  path  to  try 
and  maintain  the  status  quo  with  regard  to  secrecy  instead  of  adapting,  it 
will  find  itself  unprepared  and  behind  the  curve  when  the  “lights  are 
turned  up”  (Spaulding,  2010). 

•  Decreasing  over-classification  will  save  U.S,  taxpayer  money. 

Particularly  during  the  current  time  of  economic  concern,  it  is  prudent  to 
include  the  cost-savings  associated  with  significantly  decreasing  U.S. 
Government  over-classification.  In  FY2009,  the  costs  associated  with 
government  security  classification  were  approximately  $8.8  billion 
dollars,  not  including  intelligence  agencies’  expenditures  (Kosar,  2010). 
By  reducing  the  amount  of  classified  information,  the  U.S.  Government 
would  see  a  decrease  in  expenditures  associated  with  safeguarding 
information. 

•  Whistleblowing  is  a  civic  duty.  Modern  society  as  a  whole  accepts  and 
understands  that  misdeeds  and  wrongdoing  occur,  and  implements 
measures  to  identify  and  correct  those  actions.  Through  the  establishment 
of  IG,  the  GAO  and  Internal  Affairs  in  the  public  sector,  and  both  internal 
and  external  auditing  bodies  in  the  private  sector,  organizations  conduct 
self-evaluations  and  submit  to  outside  oversight.  Whistleblowing  is  an 
important  part  of  this  process,  as  whistleblowers  are  in  a  unique  position 
to  observe  misconduct  in  their  organizations  (Miethe,  1999).  Multiple 
studies  have  been  conducted  on  fraud  detection,  and  not  only  have  the 
results  of  these  studies  supported  the  role  of  whistleblowers  in  detecting 
fraud,  they  even  go  as  far  to  identify  whistleblowers  as  the  “single  most 
effective  source  of  information  in  both  detecting  and  rooting  out  corporate 
criminal  activity”  (Kohn,  2011).  From  the  earliest  days  of  this  republic,  as 
far  back  as  1778,  Congress  has  repeatedly  used  the  term  “duty”  to  describe 
the  act  of  whistleblowing. 

•  The  government  is  committed  to  providing  whistleblower  protections. 

Whistleblowing  is  at  the  heart  and  soul  of  the  1st  Amendment, 
establishing  the  right  of  the  people  to  expose  wrongdoing  and  demand 
accountability  of  their  leadership  (Kohn,  2011).  Since  that  time,  with  the 
passage  of  the  False  Claims  Act,  the  Civil  Rights  Act,  the  Civil  Service 
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Reform  Act  and  the  subsequent  Whistleblower  Protection  Act,  Congress 
has  displayed  support  for  whistleblowers,  using  legislation  to  protect  and 
promote  the  act  of  whistleblowing.  It  even  has  gone  so  far  as  to  explicitly 
state,  “The  Committee  intends  that  disclosures  be  encouraged.  The  OSC 
[Office  of  Special  Counsel],  the  [Merit  Systems  Protection]  Board,  and  the 
courts  should  not  erect  barriers  to  disclosures  which  will  limit  the 
necessary  flow  of  information  from  employees  who  have  knowledge  of 
government  wrongdoing”  (U.S.  Senate,  2002). 

•  Whistleblowers  are  in  large  part  motivated  by  patriotism  and  loyalty. 

Research  into  whistleblowing  has  concluded  that  despite  the  assumptions 
to  the  contrary,  no  “whistleblowing  personality”  exists.  The  motivations 
for  whistleblowers  are  neither  total  altruism,  nor  total  self-interest. 
Whistleblowers  are  impacted  more  by  situational  factors  than  dispositional 
ones,  and  often  are  faced  with  a  challenge  of  loyalties.  Their  “loyalty  to 
the  agency  and  colleagues  often  gets  pitted  against  loyalty  to  the  public 
interest”  (Johnson,  2003),  and  they  are  forced  to  choose  between  the  two, 
which  has  been  called  the  “choiceless  choice,”  for  their  loyalty  to  principle 
and  a  commitment  to  preventing  harm  in  the  service  of  the  nation 
outweighs  all  other  factors.  Whistleblowers  choose  to  act  in  the  face  of 
serious  risks  of  retaliation  and  reprisal,  and  should  be  treated  as 
performing  a  heroic  act. 

•  Anonymity  is  a  positive  thing  for  whistleblowers.  Overwhelming 
authority  and  group  pressure  to  conform  and  prioritize  organizational 
loyalty  have  dominated  the  current  environment.  Cultural  and  societal 
demands  reinforce  that  pressure  to  not  ‘make  waves’  among  employees.  In 
these  situations,  providing  employees  with  anonymity  can  actually 
promote  breaking  rank  and  whistleblowing,  which  can  be  seen  in  the 
increased  use  of  hotlines  and  anonymous  tips  in  government,  law 
enforcement,  and  the  private  sector.  Through  increased  availability  of 
anonymity  in  whistleblower  submission  processes,  it  is  likely  that  the 
amount  of  whistleblowing  overall  would  increase  significantly. 

•  Fourth  and  Fifth  Estates  provide  alternatives  to  the  government 
process.  The  Fourth  Estate  has  played  a  role  in  government  transparency 
back  to  the  18th  century.  The  media  has  served  as  a  government 
‘watchdog,’  providing  transparency  and  accountability  through  the 
application  of  public  pressure.  The  Fourth  Estate  has  provided 
whistleblowers  an  alternative  way  to  achieve  positive  change,  often 
without  the  personal  risks  associated  with  the  authorized  processes. 
However,  with  the  decline  of  investigative  journalism  and  the  increase  in 
political  influence  over  the  Fourth  Estate,  along  with  the  rise  of  the 
Internet  and  social  media  as  a  communication  platform.  Fifth  Estate 
organizations  (such  as  Wikileaks)  have  provided  whistleblowers  another 
alternative.  Through  the  application  of  anonymity  via  the  Internet,  and 
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access  to  a  worldwide  audience,  Fourth  and  Fifth  Estate  submissions 
provide  greater  ineentives  for  whistleblowers  than  the  eurrent  authorized 
processes. 

•  Public  trust  in  the  government  has  declined.  As  of  April  2011,  public 
distrust  and  anger  towards  the  government  had  risen  to  86  pereent.  With 
regard  to  whistleblowing  and  transparency,  the  aetions  of  the  Obama  and 
Bush  administrations  have  only  served  to  increase  public  (and 
whistleblower)  distrust.  Creating  a  cireumstance  in  whieh  the  head  of  the 
organization  responsible  for  investigating  retaliation  on  behalf  of 
whistleblowers,  is  in  fact,  conducting  retaliatory  practices,  combined  with 
the  Obama  Administration’s  unparalleled  prosecution  of  whistleblowers 
(signifieantly  more  than  any  previous  administration  (Greenwald,  2010) 
have  signifieantly  damaged  publie  perception  and  trust  in  the  government 
process.  When  further  acknowledging  that  the  Congressional  approval 
rating  has  fallen  to  approximately  13%  as  of  Deeember  2010  (the  lowest 
in  Gallup  history),  little  doubt  remains  that  publie  trust  has  deelined,  and  it 
will  take  signifieant  efforts  to  rebuild  it  (Jones,  2010). 

•  Public  trust  can  be  increased  through  the  use  of  third  parties.  Third 
parties  have  traditionally  been  used  to  overeome  issues  of  trust,  and 
examples  can  be  found  in  the  areas  of  E-eommeree,  mediation,  secure 
communieations,  and  online  transaetions.  Even  the  government  has  used 
third  parties  to  promote  aeeountability  through  the  ereation  of  semi¬ 
independent  investigation  organizations,  sueh  as  IG  and  the  GAO. 
Guidanee  to  whistleblowers  often  ineludes  a  recommendation  to  find  an 
advoeacy  agent  or  proxy,  who  ean  serve  to  represent  their  interests  and 
provide  additional  proteetions.  Through  the  eareful  seleetion  and 
applieation  of  a  third  party,  the  U.S.  Government  can  increase  its 
eredibility  and  overall  public  trust  in  its  efforts. 

•  Technology  exists  to  provide  anonymity  to  whistleblowers.  While  no 
teehnological  solution  can  provide  100%  anonymity,  measures  ean  be 
applied  to  provide  significant  identity  proteetions  for  whistleblowers. 
Through  the  use  of  proxy  servers,  sueh  as  The  Onion  Router  (TOR)  or  a 
third  party  Virtual  Private  Network  (VPN),  and  ‘good  hygiene,’ 
whistleblowers  ean  signifieantly  inerease  their  ability  to  keep  their 
identities  secret  (at  least  from  the  government  organization  to  whieh  they 
are  submitting  their  report).  However,  anonymity  often  comes  at  the  cost 
of  information  security. 

•  Current  options  for  whistleblowing  are  inadequate.  Currently,  many 
options  exist  for  both  the  authorized  and  unauthorized  submission  of 
whistleblower  information.  Authorized  options  come  with  signifieant  risks 
to  the  whistleblowers,  even  in  eases  of  government  sponsored 
“anonymous  hotlines,”  and  the  protections  provided  to  employees  via 
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legislation  are  inadequate.  Even  fewer  proteetions  exist  for  employees  of 
national  seeurity  organizations.  Based  on  the  realities  of  the  current 
whistleblowing  environment  and  the  government’s  inability  to  address 
these  issues,  employees  are  being  encouraged  either  to  stay  silent  or  to 
report  wrongdoing  through  unauthorized  channels.  However,  unauthorized 
channels  come  with  their  share  of  drawbacks  including  issues  with 
anonymity,  the  increasing  ability  of  political  pressures  to  affect  Fourth 
Estate  organizations,  and  the  very  real  risk  of  the  disclosure  of 
information,  which  could  have  serious  impacts  on  El.S.  national  security — 
particularly  with  Fifth  Estate  organizations. 
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IV.  SOLUTIONS 


In  national  security  there  is  a  culture  of  confidentiality,  the  need  to  protect 
the  nation’s  most  sensitive  information.  In  homeland  security  there’s  an 
expectation  of  transparency:  it’s  not  a  need  to  know,  it’s  a  duty  to  share, 
it’s  an  expectation  to  share.  In  national  security  there’s  unity  of  command. 

In  homeland  security,  it’s  a  unity  of  effort. 

-  Jane  Holl  Lute,  Deputy  Secretary  of  Homeland  Security  (Bellavita, 

2011) 

A,  DEFINITION  OF  SUCCESS 

It  is  clear  that  whistleblowing  serves  as  a  checks  and  balances  system  for  the 
government  bureaucracy,  helping  to  bypass  administrative  roadblocks  and  to  provide  a 
mechanism  through  which  homeland  security  can  monitor  and  increase  efficiency  in  its 
operations.  However,  homeland  security  also  deals  with  information  that  can  be  of  a 
sensitive  or  secret  nature,  the  unauthorized  disclosure  of  which  can  cause  damage  to  both 
homeland  security  efforts  and  national  security.  By  creating  an  authorized  process 
through  which  homeland  security  employees  can  submit  whistleblowing  information 
without  fear  of  reprisals,  it  may  increase  the  likelihood  of  whistleblowers  reporting  issues 
in  the  first  place,  and  reduce  the  number  of  leaks  to  unauthorized  recipients 
(media/stateless  news  organizations). 

Based  on  the  background  and  analysis  sections  of  this  thesis,  specifically  the 
conclusions  above,  it  is  possible  to  identify  a  number  of  potential  solutions  to  the 
whistleblowing  problem.  However,  prior  to  the  evaluation  of  these  solutions,  criteria 
must  be  established  by  which  any  potential  solution  for  whistleblowing  can  be  measured. 
To  develop  evaluation  criteria,  it  is  important  to  define  success  for  any  whistleblowing 
solution.  That  definition  is  as  follows: 

To  promote  the  voluntary  disclosure  of  information  by  any  man  or  woman 
who  reasonably  believes  that  organizational  wrongdoing  has  occurred,  the 
facilitation  of  corrective  action  to  address  the  wrongdoing,  and  providing 
for  the  protection  of  the  submitter  while  maintaining  information  security, 
all  within  the  bounds  of  U.S.  law. 
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B,  EVALUATION  CRITERIA 

Two  primary  objectives  any  whistleblowing  solution  must  have  to  facilitate  the 
whistleblowing  process  successfully  are  as  follows. 

•  Acceptance  by  whistleblowers:  In  the  absence  of  legitimate  protections 
against  retaliation,  and  based  on  the  needs  identified  in  the  analysis,  the 
recommended  solution  must  meet  or  exceed  the  minimum  needs  of 
whistleblowers  to  be  successful.  The  minimum  needs  for  whistleblowers 
include  the  following. 

•  Anonymity.  Defined  as  the  inability  of  the  government  sufficiently 
to  identity  the  subject  (whistleblower)  from  within  a  set  of  subjects 
(all  government  employees.)  This  definition  has  been  derived  from 
Andreas  Pfitzmann  and  Marit  Hansen’s  Anonymity,  Unlinkability, 
Undetectability,  Unobservability,  Pseudonymity,  and  Identity 
Management — A  Consolidated  Proposal  for  Terminology. 

•  Feedback.  Whistleblowers  require  feedback  associated  with  their 
report,  including  confirmation  from  the  government  to  the 
whistleblower  that  the  information  has  been  received  and  follow¬ 
up  information  regarding  the  action  that  will  be  taken. 

•  Corrective  Action.  Whistleblowers  submit  their  reports  with  the 
hope  of  facilitating  corrective  action  to  address  the  wrongdoing. 

•  Acceptance  by  the  government:  Based  on  the  needs  identified  in  the 
analysis  model,  the  recommended  solution  must  meet  or  exceed  the 
minimum  needs  of  the  government  to  be  successful.  The  minimum  needs 
for  the  government  are  as  follows. 

•  Information  Security.  Defined  as  the  protection  of  information 
from  access,  use,  disclosure,  disruption,  modification,  or 
destruction  by  unauthorized  third  parties.  This  definition  has  been 
derived  from  the  U.S.  Code,  title  44  §  3542. 

•  Legality  and  Political  Acceptability.  To  implement  any 
recommended  solution,  it  must  adhere  to  all  current  laws  and  legal 
requirements,  and  it  must  also  be  deemed  “politically  acceptable” 
or  in  ‘government  speak’ — has  to  pass  the  “ho-ho  test.” 

•  Issues  involving  cost  as  an  evaluative  measure:  Government  activities  are 
often  measured  using  a  cost  metric,  and  based  on  (in  situations  where 
possible)  return  on  investment.  In  this  case,  however,  cost  is  not  a  primary 
evaluative  factor,  as  it  is  extremely  difficult  to  place  value  on  homeland 
security  whistleblowers  (as  opposed  to  corporate/wall  street 
whistleblowing  to  the  Securities  and  Exchange  Commission  that  can  be 
measured  in  a  dollar  value). 
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Using  the  above  criteria,  it  is  possible  to  evaluate  potential  solutions  to  the  current 
problems  facing  government  whistleblowers.  While  it  would  be  difficult  quantitatively  to 
measure  the  criteria  independently,  a  qualitative  approach  is  useful  whereby  solutions  are 
ranked  relative  to  the  status  quo  and  each  other  for  anonymity,  feedback,  corrective 
action,  and  for  its  ability  to  meet  government  requirements  for  information  security.  What 
follows  employs  theoretical  sensitivity  to  conduct  the  “ho-ho  test”  (Tarbet,  2009)  for 
political  acceptability. 

C.  SOLUTIONS  ANALYSIS 

Current  U.S.  whistleblower  policies  attempt  to  provide  protections  by  addressing 
retaliation  and  retribution  after  they  have  occurred,  although  success  has  been  limited.  As 
clearly  identified  in  the  analysis  section  of  this  thesis,  the  status  quo  regarding  options  for 
whistleblowers  is  unacceptable,  with  both  authorized  and  unauthorized  solutions  failing 
to  meet  the  evaluation  criteria  and  falling  short  of  achieving  success  as  defined  above. 
Through  the  innovative  application  of  technology  and  the  development  or  revision  of  the 
current  DHS  submission  processes,  it  would  be  possible  to  provide  whistleblower 
protections  prior  to  retaliation. 

Note:  Solutions  that  involve  direct  disclosure  to  the  Fourth  or  Fifth  Estates  has  not 
been  included.  The  legal  status  of  Fourth  Estate  solutions  (such  as  the  sites  set  up  by  The 
Wall  Street  Journal  and  Al-Jazeera)  is  questionable  at  best,  and  falls  short  on  the  criteria 
for  both  whistleblowers  and  the  government.  Eifth  Estate  solutions  are  not  permissible 
within  U.S.  law. 

It  is  important  to  keep  in  mind  that  100%  security  does  not  exist  or  is  possible, 
just  as  regards  100%  anonymity.  The  steps  outlined  herein  are  only  one  piece  of  the 
overall  puzzle,  and  their  success  is  very  dependent  upon  the  actions  of  both  the  submitter 
and  the  government.  No  process  will  work  based  on  the  needs  of  one  party  (government 
or  whistleblower),  and  any  solution  will  have  to  provide  each  with  assurances  and  a  level 
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of  trust  in  the  process.  If  the  government  is  committed  to  taking  steps  to  prevent  the 
unauthorized  disclosure  of  information,  it  needs  to  provide  an  alternative  that  does  not 
jeopardize  the  employee’s  livelihood. 

At  first  glance,  two  possibilities  may  address  both  the  whistleblowers  and  the 
Government’s  concerns. 

These  options  are  based  on  the  following  key  components. 

•  The  government  establishes  a  submission  site  based  on  an  apache-ssl 
server  (or  equivalent)  to  ensure  appropriate  end-to-end  encryption  is  used 
to  maintain  information  security. 

•  The  government  provides  the  ‘public-key  fingerprint’  for  its  submission 
site  to  employees  in  a  non-traceable  way  (perhaps  in  their  “new  employee 
packet”  or  on  the  DHS  Intranet),  to  allow  whistleblowers  to  authenticate 
the  government’s  certificate  and  preventing  Man-in-the-middle  (MITM) 
attacks. 

•  Submitters  practice  ‘good  hygiene’  with  regard  to  their  actions  and 
submission,  including  stripping  all  identifiable  information  from  their 
submission,  running  malware/spyware  and  virus  scanners,  and  taking 
precautions  when  using  technology  to  submit  information  (not  browsing 
openly  while  they  browse  anonymously)  to  prevent  overlap  and 
java/cookie  exploits. 

•  Submitters  only  use  these  options  periodically.  For  example,  if  users  are 
constantly  submitting  information  to  the  government  server  using  TOR, 
trend/traffic  analysis  can  be  used  to  identify  them. 

1,  Option  1:  Whistleblowers  and  Internet  Anonymity 

Option  1  is  a  solution  almost  entirely  implemented  by  whistleblowers,  using  the 
Internet  to  provide  anonymity  as  they  submit  to  authorized  government  channels  (such  as 
the  OSC,  DHS  IG,  or  GAO),  which  could  be  accomplished  by  using  their  home  computer 
and  by  downloading  and  leveraging  the  TOR  Browser  (Tor,  n.d.b.) — a  self-contained 
instance  of  TOR  with  many  of  the  vulnerabilities  disabled.  This  option  is  primarily 
designed  for  the  average  government  employee  who  does  not  have  much  experience  with 
proxy/onion  routing/VPN  technology.  Experienced  employees  could  use  Jondonym,  I2P, 


70 


or  a  third  party  VPN,  as  long  as  they  are  aware  of  the  logging/information  sharing 
policies  of  the  company  they  choose.  With  this  solution,  it  would  not  be  possible  legally 
to  submit  sensitive  or  classified  information. 

2,  Option  2:  Government  Established  VPN 

In  this  case,  the  government  would  create  a  VPN  service  hosted  by  DHS  or 
Congress.  This  VPN  would  be  solely  for  submitting  whistleblower  claims,  and  access 
could  be  provided  to  all  government  employees.  This  VPN  would  provide  anonymity  to 
the  submitter,  while  ensuring  that  any  appropriate  measures  are  taken  to  ensure 
information  security.  With  this  solution,  it  would  be  possible  legally  to  submit  sensitive 
or  classified  information. 


Option  1 

Option  2 

Anonymity 

Good 

Unknown 

Feedback 

questionable 

questionable 

Corrective  Action 

questionable 

questionable 

Information  Security 

questionable 

Good 

Legal/Political  Acceptability 

questionable 

Good 

Good,  Questionable,  Impossible,  Unknown 

Table  1.  Analysis  of  the  Options 


Anonymity:  Option  1  is  better  than  option  2  in  terms  of  providing  the  best 
protections  for  the  whistleblower,  ensuring  anonymity,  which  is  largely  due  to  the  actual 
or  perceived  issues  associated  with  government  sponsored  ‘hotlines.’  While  the 
technology  associated  with  option  2  may  in  fact  be  superior  to  option  1,  public  distrust  in 
the  implementation  would  likely  result  in  few  whistleblowers  using  the  solution. 
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Feedback:  Both  option  1  and  option  2  suffer  from  the  same  problem  in  terms  of 
feedback.  It  is  difficult  for  any  solution  to  provide  feedback  while  maintaining  the 
anonymity  of  the  submitter.  Option  2  would  have  a  slight  advantage,  in  that  the 
government  could  establish  a  process  through  which  whistleblowers  are  issued  a  case 
number,  and  are  able  to  follow  up  with  their  submission  on  a  public  site. 

Corrective  Action:  As  with  feedback,  both  options  fall  short  on  this  criterion.  The 
likelihood  of  corrective  action  is  not  dependent  upon  how  the  submission  is  made,  as  any 
submissions  to  authorized  recipients  (IGs,  GAO,  or  Congress)  have  the  potential  for 
inaction. 

Information  Security:  Option  2  is  clearly  superior  to  option  1  in  terms  of 
information  security.  By  using  a  government  sponsored  VPN,  the  information  is  more 
likely  to  remain  securely  within  the  government,  while  both  TOR  and  third-party  VPNs 
allow  for  the  possibility  of  the  information  to  be  intercepted.  Unlike  with  option  2,  it 
would  be  impossible  legally  to  submit  classified  information  using  option  1. 

Legal/Political  Acceptability:  Option  2  is  superior  to  option  1  in  terms  of 
legal/political  acceptability  as  well.  If  the  government  chooses  to  institute  a  new  policy 
for  whistleblowers,  it  is  more  likely  to  be  accepted  and  authorized  than  if  whistleblowers 
took  it  upon  themselves  to  use  the  Internet  for  submission. 

In  examining  both  options  based  on  the  evaluation  criteria,  it  is  clear  that  neither 
of  these  solutions  has  the  ability  to  meet  the  needs  of  both  whistleblowers  and  the 
government.  Option  1  would  likely  be  rejected  by  the  government  due  to  concerns  about 
information  security  and  legal/political  acceptability,  while  option  2  would  be 
disregarded  by  whistleblowers  as  not  providing  them  protections  through  anonymity, 
largely  due  to  lack  of  trust/credibility.  Additionally,  neither  of  these  options  has  the 
ability  to  address  corrective  action  in  any  way,  making  them  unacceptable  in  terms  of 
achieving  success  as  defined  above. 
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Nevertheless,  with  a  review  of  the  problem,  the  evaluation  criteria,  and  the 
shortfalls  associated  with  the  first  two  options,  a  third  possibility  emerges.  This  option  is 
based  on  the  foundation  for  the  technological  solution  proposed  by  option  2,  but  relies  on 
a  third  party  to  address  the  issues  of  distrust  and  lack  of  credibility. 

3,  Option  3:  Government  Sponsored  Third  Party  VPN 

In  this  case,  the  government  would  form  partnership  with  a  NGO  with  credibility 
for  promoting  and  maintaining  anonymity,  and  authorize  the  creation  of  a  VPN  service 
hosted  by  the  identified  NGO.  This  VPN  would  be  solely  for  submitting  whistleblower 
claims,  and  access  could  be  provided  to  all  government  employees.  Policies  would  have 
to  be  established  to  ensure  that  the  NGO  would  meet  the  whistleblowers’  expectations  of 
anonymity,  while  also  ensuring  the  government’s  requirements  for  information  security 
are  met.  With  this  solution,  it  would  be  possible  to  explore  the  submission  of  sensitive 
and  classified  information.  Additionally,  this  option  would  also  include  a  tiered  reporting 
process,  the  application  of  which  would  prompt  corrective  action  and  provide 
accountability  through  escalation. 


Option  1 

Option  2 

Option  3 

Anonymity 

Good 

Unknown 

Good 

Feedback 

questionable 

questionable 

questionable 

Corrective  Action 

questionable 

questionable 

Good 

Information  Security 

questionable 

Good 

Good 

Legal/Political  Acceptability 

questionable 

Good 

questionable 

Good,  questionable,  impossible,  unknown 

Table  2.  Analysis  of  Option  3 


Anonymity:  Option  3  is  superior  to  both  options  1  and  2  in  terms  of  providing  the 
best  protections  for  the  whistleblower  for  anonymity.  This  option  leverages  the 
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technological  protections  possible  thorough  the  use  of  a  third-party  VPN  (with  strict 
policies  against  the  logging  of  IP  addresses),  and  with  an  appropriate  selection  of  a  third 
party,  would  lend  credibility  and  increase  public  trust  in  the  process. 

Feedback:  Option  3  suffers  from  the  same  problems  as  options  1  and  2  in  terms  of 
feedback.  It  is  difficult  for  any  solution  to  provide  feedback  while  maintaining  the 
anonymity  of  the  submitter.  Options  2  and  3  would  have  a  slight  advantage,  in  that  the 
government  could  establish  a  process  through  which  submitters  are  issued  a  case  number, 
and  are  able  to  follow  up  with  their  submission  on  a  public  site. 

Corrective  Action:  With  option  3,  comes  the  tiered  reporting  process,  similar  to 
the  one  discussed  above,  which  would  prompt  corrective  action  and  provide 
accountability  through  the  possibility  of  escalation.  In  cases  in  which  one  tier  fails  to  act, 
the  next  tier  would  be  activated,  which  significantly  benefit  the  government  in  that  it 
would  provide  the  opportunity  to  address  reported  issues  prior  to  their  public  release  (or 
instead  of  their  public  release). 

Information  Security:  As  option  3  is  a  government  sponsored/approved  third  party 
and  based  on  the  technology  solution  proposed  in  option  2,  it  shares  superiority  to  option 

1  in  terms  of  information  security.  By  using  a  government  sponsored  third-party  VPN, 
the  information  is  more  likely  to  remain  securely  within  authorized  government  channels, 
while  both  TOR  and  unauthorized  third-party  VPNs  allow  for  the  possibility  of  the 
information  to  be  intercepted.  Option  3  is  similar  to  option  2  in  that  it  would  be  possible 
legally  to  submit  classified  information. 

LegaFPolitical  Acceptability:  The  one  area  in  which  option  3  falls  short  of  option 

2  is  in  terms  of  political  acceptability.  Legally,  the  government  regularly  authorizes  third- 
party  contractors  to  have  access  to  sensitive  and  classified  information.  However,  this 
option  does  push  the  boundaries  of  political  acceptability  both  through  the  injection  of  a 
third  party  into  the  disclosure  process  and  through  the  creation  of  a  tiered  submission 
process  that  includes  the  possibility  of  public  disclosure. 
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The  proposal  of  a  third-party  solution  requires  the  development  of  additional 
evaluation  criteria.  Two  primary  factors  drive  the  selection  of  the  third-party 
organization,  its  ability  to  engender  public  trust  and  lend  credibility  to  the  process,  and  its 
current  financial  disposition.  As  with  the  application  of  any  technology  and  the 
implementation  of  policy,  associated  funding  must  be  available.  To  avoid  conflict  of 
interest  situations,  it  is  important  that  funding  from  the  government  be  provided  directly 
through  Congress  (instead  of  through  one  agency,  e.g.,  DHS).  The  amount  of  funding  the 
organization  receives  from  the  government  (beyond  just  the  funding  for  this  process) 
should  not  exceed  2-3%  of  the  organization’s  total  income,  and  the  organization  itself 
must  provide  transparency  on  its  budget  numbers.  Two  additional  factors  should  be 
noted,  the  organizations’  willingness  to  participate  in  the  process,  and  the  government’s 
willingness  to  engage  with  that  organization. 

Two  types  of  non-governmental  organizations  could  meet  the  criteria  identified 
above.  The  first  is  whistleblowing  advocate  organizations,  such  as  the  Project  on 
Government  Oversight  (POGO),  the  Government  Accountability  Project  (GAP),  and  the 
Sunlight  foundation.  The  second  type  includes  Internet  privacy  and  civil  liberty 
organizations,  such  as  the  Electronic  Frontier  Foundation  (EFF)  and  the  Electronic 
Privacy  Information  Center  (EPIC).  A  consortium  approach  could  also  be  effective  in  the 
application  of  this  process. 

D,  EDUCATIONAL  CAMPAIGN 

As  discussed  above,  even  if  a  technological  solution  was  able  to  provide  100% 
confidentiality/anonymity  (which  it  cannot),  arguably  the  most  significant  vulnerabilities 
are  associated  with  an  individual’s  due  diligence  in  scrubbing  any  information  submitted 
for  other  potential  identifiers.  Electronic  documents  often  contain  watermarks  and 
electronic  signatures  that  can  be  tracked,  emails  can  be  used  to  identify  the  recipients,  and 
the  more  limited  the  access  associated  with  the  information  being  submitted,  the  more 
likely  the  individual  submitter  could  be  identified.  For  example,  the  submission  of  details 
from  a  meeting  with  few  attendees  or  a  sensitive  memo  or  email  with  limited  recipients 
would  make  it  easy  to  identify  the  individual  filing  the  submission.  Both  The 
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Whistleblower’s  Handbook  and  The  Art  of  Anonymous  Activism  promote  ‘good  hygiene’ 
and  identify  ‘self-help  tactics’  that  whistleblowers  can  use  to  protect  themselves.  These 
tactics  include  understanding  whistleblower’s  rights  and  limitations,  avoiding  breaking 
the  law,  identifying  and  using  an  advocacy  partner  (outside  organization  to  act  on  the 
whistleblower’s  behalf),  documenting  information  thoroughly,  and  not  using  government 
resources  or  operating  on  government  time  (Kohn,  2011;  Project  on  Government 
Oversight,  2002).  This  information  would  need  to  be  made  publicly  available  to  any 
employee  considering  whistleblowing  to  ensure  awareness  of  the  risks,  so  that  the 
appropriate  measures  can  be  taken  to  decrease  the  likelihood  of  identification  and 
potential  retaliation.  Furthermore,  the  education  of  employees  as  to  the  process  itself 
needs  to  be  a  high  priority.  In  an  American  Federation  of  Government  Employees 
(AFGE)  survey,  87%  of  respondents  were  not  aware  of  how  to  contact  their 
whistleblowing  hotline,  62%  did  not  know  where  to  get  the  number,  and  only  22%  had 
seen  the  number  posted  in  their  work  area  (Johnson,  2003).  By  prioritizing  and  promoting 
responsible  disclosure  through  the  modification  and  utilization  of  existing  trainings  (such 
as  the  No  Eear  Act  training),  online  information  sites  (DHS  Intranet),  employee  welcome 
packets,  reminder  emails  and  posters  (such  as  the  Operational  Security  posters  found 
everywhere  in  DHS  offices),  employees  can  be  informed  of  the  process  for  responsible 
disclosure,  as  well  as  the  associated  risks. 

E,  PROCESS  FOR  INVESTIGATING  ANONYMOUS  TIPS 

Some  concerns  about  the  impact  of  anonymity  on  whistleblower  submissions 
have  been  raised,  as  it  decreases  accountability  for  employees  making  accusations.  It  is 
important  to  bear  in  mind  that  although  this  process  encourages  whistleblowing  by 
providing  the  protections  associated  with  anonymity,  not  every  submission  will  merit 
action  or  in-depth  investigation.  A  vetting  process  associated  with  whistleblower 
submissions  must  exist,  including  a  prioritization  (by  perceived  significance)  and  a 
preliminary  investigation  (to  determine  merit).  Prioritization  can  be  assisted  through  an 
identification  of  significance  by  the  whistleblower  during  the  submission  process.  Eor 
example,  national  security  vulnerabilities  may  be  of  high  significance/priority,  while 
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human  resource  complaints  and  issues  may  rank  lower.  With  the  realities  associated  with 
limited  resources  for  investigating  agencies  (IG,  the  OSC,  etc.),  prioritizing  submissions 
prior  to  the  conduct  of  preliminary  investigations  may  help  address  the  expected  increase 
in  whistleblower  submissions. 

The  current  OSC  investigation  process  serves  as  an  informative  model  on  how  to 
conduct  investigations  into  whistleblower  claims.  The  OSC  process  is  initiated  through 
the  submission  of  a  whistleblower  report.  The  OSC  has  15  days  to  review  the  information 
and  determine  whether  further  investigation  is  necessary.  If  the  OSC  finds  substantial 
indication  of  wrongdoing,  it  informs  the  appropriate  agency  head  of  the  matter.  That 
agency  head  is  required  to  conduct  an  investigation  and,  within  60  days,  identify  the 
following:  a  summary  of  the  disclosure  leading  to  the  investigation,  a  description  of  how 
the  investigation  was  conducted,  a  summary  of  all  evidence  found  during  the 
investigation,  a  list  of  any  real  or  apparent  violations,  and  a  description  of  any  action 
either  taken  or  planned  to  be  taken  in  response  to  the  violation.  Upon  receipt  of  the 
report,  the  OSC  reviews  it  and  provides  it  to  the  whistleblower,  who  then  has  15  days  to 
submit  any  additional  comments  to  the  OSC.  The  OSC  then  transmits  the  agency  report, 
any  comments  added  by  the  whistleblower,  and  any  additional  comments  from  the  OSC 
to  the  President,  congressional  leadership,  and  the  congressional  committee(s)  holding 
jurisdiction  over  the  agency.  It  is  also  made  public  on  file  at  OSC  headquarters  (Project 
on  Government  Oversight,  2002).  While  the  OSC  process  provides  a  good  framework  for 
an  investigatory  process,  some  drawbacks  and  issues  do  exist,  which  must  be  addressed 
in  the  proposed  policy  for  it  to  be  successful.  These  issues  include  the  concerns  about 
confidentiality  of  the  whistleblower,  the  issues  associated  with  having  the  accused  agency 
conduct  its  own  investigations,  and  ultimately,  the  public  availability  of  the  report. 

Through  the  application  of  an  appropriate  process,  concerns  regarding  the 
legitimacy  of  anonymous  submissions  can  be  addressed.  In  cases  of  retaliation/reprisal 
against  whistleblowers,  the  single  most  prominent  tactic  employed  by  accused  agencies  is 
to  attack  the  whistleblowers  on  their  credibility  (Miethe,  1999;  Kohn,  2011).  By  creating 
a  process  that  utilizes  anonymity,  whistleblowers  are  removed  from  the  equation  entirely. 
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including  the  questions  regarding  their  motivations  (money,  notoriety,  etc.).  It  is 
impossible  to  collect  rewards  under  the  False  Claim  Act  if  the  whistleblower  is  not 
identified.  Through  this  proeess,  on  the  focus  is  on  the  pursuit  of  the  truth  regarding  the 
aecusations  of  wrongdoing,  rather  than  questioning  the  whistleblower. 

F.  RECOMMENDATION 

The  conclusions  drawn  in  this  thesis,  including  the  policy  model  ultimately 
recommended,  is  based  on  the  research  and  the  findings  identified  above.  Assuming  these 
premises  are  true,  and  based  on  eurrent  understanding  of  the  problem,  the  evaluation 
criteria,  and  the  potential  solutions  available,  it  is  reeommended  that  the  government 
establish  a  partnership  with  a  non-government  organization  within  U.S.  legal  jurisdiction 
(e.g.,  EFF,  EPIC,  POGO),  and  subsidize  the  establishment  of  a  government  sponsored 
whistleblower  submission  website  and  VPN.  The  third  party  would  provide  information 
on  how  whistleblowers  could  access  their  VPN  to  submit  their  information,  as  well  as 
best  practices  to  follow  regarding  information  security  and  maintaining  anonymity.  The 
NGO  would  have  to  create  a  strict  policy  regarding  the  logging  of  IP  addresses.  The  third 
party  would  also  maintain  and  update  the  submission  website  with  information  regarding 
the  status  of  submitted  reports. 

This  organization  is  a  neutral  third  party,  and  would  serve  as  a  mediator  between 
the  whistleblower  and  the  government.  Its  functions  as  broker  on  behalf  of  the 
whistleblower,  submitting  information  to  the  government  and  following  up  to  ensure  the 
information  was  evaluated  and  appropriate  aetions  were  determined.  This  organization 
also  functions  to  balance  the  seereey/transparency  debate,  weighing  the  publie  interest 
against  issues  of  national  seeurity.  In  cases  in  whieh  the  government  has  decided  not  to 
act  (in  either  first  or  seeond  tier  submissions),  the  third  party  would  have  the  ability  to 
review  the  information,  and  discuss  the  issues  with  both  parties  (should  the  whistleblower 
ehoose  to  step  forward).  Deeisions  to  escalate  to  public  disclosure  require  eareful 
considerations,  whieh  however,  may  be  considered  necessary  in  certain  situations.  This 
proeess  promotes  eorreetive  action  by  the  government  in  addressing  organizational 
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wrongdoing  through  the  accountability  provided  by  the  additional  tiers  of  review. 
Inaction  on  the  part  of  one  organization  will  be  questioned  by  the  subsequent  level  of 
oversight. 

Of  the  spectrum  of  options,  ranging  from  achieving  all  of  the  government’s 
primary  concerns  to  meeting  the  needs  of  whistleblowers,  this  option  falls  slightly  to  the 
right  of  center.  It  is  not  as  extreme  as  allowing  submissions  to  an  organization  like 
Wikileaks  (which  the  status  quo  is  currently  encouraging)  or  the  use  of  self-generated 
anonymity  by  whistleblowers.  However,  it  does  acknowledge  the  need  for  change  in  the 
government’s  whistleblowing  procedures.  By  bringing  an  NGO  into  the  mix,  the 
government  takes  huge  steps  in  rebuilding  public  trust  and  legitimizing  the  role  that 
whistleblowers  play  in  government  affairs.  Regarding  political  acceptability  and 
information  security,  a  precedent  exists  for  NGOs  (consultants,  etc.)  to  have  access  to  and 
store  classified  information.  By  certifying  the  submission  and  storage  process/procedures, 
the  government  can  be  sure  that  information  security  requirements  are  met. 
Whistleblowers  are  more  likely  to  trust  a  NGO  to  maintain  their  anonymity  (particularly 
those  with  a  track  record  like  the  EFF’s).  Establishing  this  policy  provides 
whistleblowers  who  truly  believe  in  improving  government  operations  through  the 
submission  of  information  on  fraud/waste/abuse  or  other  types  of  concerns,  a  legitimate 
way  to  achieve  their  goal  without  risking  their  career  and  future  on  the  weak 
whistleblower  protections  currently  in  place.  While  it  may  not  completely  eliminate  leaks 
to  the  media  or  organizations,  such  as  Wikileaks,  the  researcher  believes  those  leaks  will 
decrease  as  more  whistleblowers  give  the  government  an  opportunity  to  act  on  their 
submission.  Additionally,  by  granting  the  NGO  oversight  ability,  the  government 
provides  the  whistleblower  with  a  ‘fail  safe’  mechanism.  If  the  government  fails  to  act, 
the  NGO  has  the  ability  to  escalate  the  release  of  information  to  the  media/public. 
However,  in  those  situations,  the  government  can  be  sure  to  establish  reasonable  limits  on 
that  release  (e.g.,  no  names  of  informants,  nuclear  weapon  design,  etc.).  Fastly,  while  this 
option  is  higher  in  cost  than  some  other  possibilities,  it  does  achieve  the  best  outcome  for 
all  parties  involved. 
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Regardless  of  the  solution  pursued  by  the  government  to  address  this  problem, 
four  key  pillars  ereate  the  foundation  for  suecess. 

•  Whistleblowers  must  have  the  support  of  leadership — This  position 
affects  all  aspects  of  whistleblower  protection,  from  the  ability  of 
Congress  to  pass  appropriate  legislation,  to  senior  leaders  at  the  DHS  and 
the  OSC  who  must  enforce  that  legislation.  If  sufficient  support  from 
leadership  does  not  exist,  whistleblowers  will  remain  unprotected. 
Problems  with  the  lack  of  clarity  around  the  definition  of  whistleblowers, 
as  well  as  the  perception  issues  that  have  resulted  from  the  Wikileaks 
disclosures  have  seriously  damaged  leadership  support  of  whistleblowers. 
Until  leadership  can  be  convinced  that  authorized  whistleblowing  is 
something  that  warrants  support,  no  solutions  will  ever  be  effective. 

•  Legislation  and  policies  must  be  clear  and  straightforward — Current 
U.S.  legislation  is  a  maze  of  contradictions,  exemptions,  and  loopholes. 
For  whistleblowers  to  feel  protected,  legislation  must  be  developed  in  a 
way  that  allows  government  employees  to  understand  it,  and  government 
agencies  to  abide  by  it.  Many  attempts  have  been  made  by  the  U.S. 
Government  to  revise  current  whistleblowing  policy;  however,  the  most 
recent  attempt  was  stopped  by  an  anonymous  hold  placed  on  the  passage 
of  the  Whistle-blower  Protection  Enhancement  Act  in  Congress,  despite 
its  bi-partisan  support  (Devine,  2011).  The  key  to  the  implementation  of 
any  solution  is  support,  both  from  leadership  and  the  public. 

•  Whistleblowing  policies  must  enforce  accountability — The  multi-tiered 
approach  for  whistleblower  submission  forces  initial  organizations  and 
oversight  agencies  to  act  upon  receipt  of  a  whistleblower’s  disclosure.  By 
establishing  authorized  alternatives  for  submission,  it  allows 
whistleblowers  to  retain  protection  for  escalating  disclosures,  while 
encouraging  agencies  to  act  appropriately  to  avoid  consequences. 

•  Authorized  channels  must  provide  at  least  as  much  protection  as 
unauthorized  channels — With  the  current  perception  that  whistleblowers 
can  submit  information  anonymously  to  unauthorized  recipients,  such  as 
the  media  or  third-party  organizations  (such  as  Wikileaks),  it  is  paramount 
that  any  government  whistleblowing  policy  provide  protections  that 
surpass  (or  are  at  least  equivalent  to)  the  perceived  protections  provided 
through  Internet  anonymity  and  Fourth  or  Fifth  Estate  submissions. 

G.  DRAFT  POLICY 

To  demonstrate  the  possibilities  associated  with  implementing  this  solution,  the 
following  draft  policy  is  presented.  This  policy  highlights  the  findings  and  conclusions  in 
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this  thesis,  while  demonstrating  the  feasibility  of  the  reeommendations.  For  the  purposes 
of  the  poliey  below,  the  details  assoeiated  with  the  name  and  eontaet  information  for  the 
third  party  are  false. 

U,S,  Department  of  Homeland  Security  Responsible  Disclosure  Policy 

Purpose:  It  is  possible  that  during  the  eonduet  of  their  everyday  jobs,  employees 
may  witness  a  variety  of  types  of  organizational  wrongdoing.  Employees  are  then  faeed 
with  a  dilemma;  do  they  stay  silent,  or  report  the  wrongdoing?  If  they  deeide  to  report  it, 
how  do  they  go  about  it  and  to  whom  should  they  go?  Reporting  organization  misconduct 
or  ‘whistleblowing,’  is  the  duty  of  every  employee,  however,  if  conducted  incorrectly  or 
through  unauthorized  channels,  the  disclosure  of  sensitive  information  can  have 
damaging  effects.  This  policy  is  designed  to  establish  the  process  through  which  DHS 
employees  may  conduct  whistleblowing  in  a  safe,  secure  manner,  without  unintended 
consequences,  which  can  jeopardize  homeland  security. 

DHS  has  partnered  with  the  “Neutral  (and  yet)  Trusted  Party”  (NTP)  organization 
for  the  purposes  of  developing  and  executing  this  Responsible  Disclosure  Process.  NTP 
has  been  funded  by  Congress  to  develop  the  Responsible  Disclosure  Information  System 
(RDIS),  a  website  where  whistleblowers  can  submit  information  anonymously  and 
receive  feedback  and  status  updates  on  their  submission. 

Goals  of  Responsible  Disclosure: 

1)  Ensure  that  instances  of  organizational  wrongdoing  are  reported  in  a 
timely  and  efficient  manner. 

2)  Minimize  the  risks  of  retaliation  and  reprisals  against  employee 
whistleblowers. 

3)  Provide  the  opportunity  for  the  Department  of  Homeland  Security  to 
address  issues  internally,  prior  to,  or  in  place  of  (in  cases  involving 
sensitive  national  security  information),  full  (public)  disclosure. 

4)  Promote  prompt  adjudication  and  resolution  of  organizational  misconduct 
by  the  Department  of  Homeland  Security  through  increased  accountability 
provided  by  oversight  and  the  possibility  of  escalation  to  full  disclosure. 
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5) 


Increase  publie  trust  in  government  and  minimize  the  amount  of 
antagonism  that  often  exists  between  parties  due  to  the  laek  of  consistent 
and  explicit  disclosure  practiees. 

6)  Reduce  diselosures  to  unauthorized  parties  by  providing  a  clear  and 
effeetive  proeess  for  the  appropriate  reporting  and  eorreetion  of 
organizational  wrongdoing. 

Definitions: 

Whistleblowing.-  the  voluntary  disclosure  by  any  man  or  woman  acting  in  the 
public  interest  who,  reasonably  believes  that  a  violation  of  any  law,  rule,  or  regulation; 
mismanagement;  a  waste  of  funds;  an  abuse  of  authority;  a  danger  to  public  health; 
and/or  a  danger  to  public  safety  has  occurred  and  reports  that  information  to  persons  or 
organizations  that  may  be  able  to  effect  action. 

Organizational  Wrongdoing/Misconduct:  the  actions  by  an  organization  or 
individual  that  result  in  ‘a  violation  of  any  law,  rule,  or  regulation;  mismanagement;  a 
waste  of  funds;  an  abuse  of  authority;  a  danger  to  public  health;  and/or  a  danger  to 
public  safety.  ’ 

Responsible  Disclosure:  the  disclosure  of  organizational  wrongdoing  to  the 
responsible  party  for  a  predetermined  amount  of  time,  to  allow  for 
modification/adaptation  to  address  the  wrongdoing  prior  to  or  in  place  of  full  disclosure. 

Limited  Disclosure:  the  disclosure  of  organizational  wrongdoing  to  as  few 
(specifically  authorized)  parties  as  possible,  to  prompt  additional  investigatory  or 
corrective  action  to  address  perceived  organizational  wrongdoing  prior  to  full 
disclosure. 

Full  Disclosure:  the  disclosure  of  organizational  wrongdoing  to  the  public  with 
the  intent  of  using  public  exposure  to  pressure  accused  organizations  to  investigate  and 
address  the  organizational  wrongdoing. 
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Major  Roles  in  Disclosure: 

Reporter:  the  individual  who  witnesses  and  diseloses  the  organizational 
wrongdoing/miseonduct.  Also  known  as  ‘Whistleblowers’  or  ‘Lamplighters.’ 

Coordinator:  the  individual  or  organization  that  serves  as  a  neutral  mediator  and 
works  with  the  reporter  and  the  Investigator  to  faeilitate  the  whistleblowing  proeess  and 
to  ensure  that  responsible  disclosure  occurs  prior  to  full  disclosure.  Coordinators  may 
serve  as  proxies  for  reporters,  helping  to  verify  claims,  resolve  conflicts,  and  mediate 
between  parties  to  resolve  the  issue  in  a  satisfactory  manner,  with  a  minimum  of 
potentially  harmful  consequences.  NTP  serves  as  the  Coordinator  for  the  U.S. 
Department  of  Homeland  Security  Responsible  Disclosure  process.  Also  known  as 
‘Ombudsman’  or  ‘Advocates.’ 

Investigator:  the  individual  or  organization  who  receives  the  report  and  is 
responsible  for  determining  whether  there  is  merit  to  the  claim  for  examining  the 
accused.  Tier  One  investigators  include  the  Department’s  Office  of  the  Inspector  General, 
DHS  Component  Offices  of  Inspectors  General,  or  the  Office  of  Special  Counsel.  Tier 
Two  investigators  include  Congress,  the  Government  Accountability  Office  and  the 
White  House. 

Leadership;  the  individual  or  organization  that  is  able  to  effect  action  to  address 
and  correct  instances  of  verified  organizational  wrongdoing. 

Accused:  the  individual  or  organization  about  which  the  initial  disclosure  was 

made. 

Who  is  covered:  This  policy  covers  all  civil  service  employees  of  the  U.S. 
Department  of  Homeland  Security,  its  detailees  and  its  contractors.  This  includes  all  DHS 
components,  including  those  that  are  identified  as  part  of  the  Intelligence  Community  and 
the  Transportation  Security  Administration. 
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Tiers  of  Responsible  Disclosure: 


This  policy  is  based  on  a  tiered  process  for  responsible  disclosure.  The  three  tiers 


are: 

a.  Tier-One — Internal:  Authorized  Tier  One  reporting  ineludes  the 
submission  of  reports  within  the  originating  agency/component  (to  include 
within  the  Reporter’s  chain  of  command),  to  the  Department’s  Office  of 
the  Inspector  General,  DHS  Component  Offices  of  Inspectors  General,  or 
the  Offiee  of  Special  Counsel. 

b.  Tier-Two — External  Limited  Disclosure:  External  reporting  includes  the 
submission  of  reports  to  Congress,  the  Government  Aceountability  Office 
or  the  White  House. 

c.  Tier- Three — External  Full  Disclosure:  In  circumstanees  where  neither 
Tier  One  or  Tier  Two  is  able  to  facilitate  correetive  action,  full  disclosure 
ean  be  made  to  the  media/public.  Full  Disclosure  can  only  be  initiated  by 
the  Coordinator. 


All  reports  submitted  will  be  reviewed  initially  through  the  first  tier,  at  which 
point  the  deeision  to  escalate  to  additional  tiers  can  be  determined  by  the  Reporter  or 
Coordinator.  However,  in  situations  where  Tier  Two  investigations  have  not  resulted  in 
action,  the  Reporter  cannot  escalate  to  Tier  Three  without  the  consent  of  the  Coordinator. 
The  Coordinator  is  a  neutral  third  party,  serving  as  a  mediator  between  the  Reporter  and 
the  Aceused/Eeadership.  They  also  funetion  to  balanee  the  secrecy/transparency  debate, 
weighing  the  public  interest  against  issues  of  national  security.  Decisions  to  escalate  to 
the  third  tier  require  eareful  eonsideration,  but  they  may  very  well  be  justified  under 
certain  circumstanees.  This  process  promotes  action  by  Eeadership  in  addressing 
organizational  wrongdoing  through  the  accountability  provided  by  the  additional  tiers  of 
review.  In  the  Responsible  Disclosure  Proeess,  inaction  will  be  questioned  by  the 
subsequent  tiers. 

Phases  of  Responsible  Disclosure 

1)  Discovery — One  or  more  individuals  discover  or  witness  activities  that 

they  reasonably  believe  eonstitute  organizational  wrongdoing 
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2)  Reporting — A  Reporter  submits  a  report  to  the  coordinator,  who  then 
removes  any  of  the  Reporter’s  personally  identifiable  information  from  the 
submission.  The  coordinator  then  forwards  the  report  to  an  appropriate 
investigator,  including  the  identity  of  the  accused  and  the  details 
surrounding  the  suspected  wrongdoing.  The  Investigator  and/or 
Coordinator  will  provide  confirmation  to  the  Reporter  that  their 
submission  was  received  through  the  DHS  Responsible  Disclosure 
Information  Site  (RDIS)  and  that  the  submission  has  been  assigned  a 
unique  case  number  for  the  submission. 

3)  Investigation — The  investigator  prioritizes  and  conducts  a  two  part 
analysis  to  determine  the  merits  of  the  submission:  within  15  days,  a  pre¬ 
investigation  analysis  is  conducted  to  determine  whether  further 
investigation  is  required.  If  it  is  determined  that  more  analysis  is 
necessary,  a  detailed  investigation  is  conducted  within  30  days,  in  order  to 
confirm  or  disprove  the  accusations  of  organizational  wrongdoing  by  the 
reporter. 

4)  Adjudication — Upon  completion  of  the  investigation,  the  Investigator 
and/or  the  Coordinator  updates  the  RDIS  with  the  investigation  status.  The 
Investigator  details  conclusions  from  their  investigation  to  the  DHS 
Leadership  for  a  15-day  review  period.  Upon  receipt  of  the  Investigator’s 
report,  DHS  Leadership  will  take  action  (where  required)  to  address  any 
legitimate  issues. 

5)  Follow-up — DHS  Leadership  will  provide  information  on  their  decision 
to  (or  not  to)  act,  to  the  Investigator  and  Coordinator.  The  Coordinator  will 
then  update  the  RDIS  with  the  actions  taken  by  Leadership  to  address  the 
issues.  The  Reporter  has  30  days  from  the  conclusion  of  the  investigation 
phase  (90  days  from  initial  submission)  to  review  (using  their  case  number 
through  the  RDIS)  and  take  appropriate  action  as  necessary.  Appropriate 
Reporter  actions  include  providing  additional  information,  coming 
forward  as  an  identified  witness  (losing  the  protections  of  anonymity),  or 
escalating  to  additional  tiers  as  appropriate.  In  situations  where  rewards 
are  applicable  (e.g.  under  the  False  Claim  Act),  the  Reporter  will  have  the 
opportunity  to  come  forward  and  claim  them  within  this  phase.  Only 
reports  on  issues  of  wrongdoing  that  do  not  have  National  Security 
restrictions  will  be  publicly  available. 

6)  Escalation — In  cases  where  the  Investigator  was  unable  to  confirm 
organizational  wrongdoing  and/or  DHS  Leadership  has  chosen  not  to  take 
action,  the  Reporter  can  escalate  the  report  to  a  Tier  Two  Investigator 
through  the  RDIS.  Should  the  reporter  decline  to  continue  to  be  involved 
in  the  process,  the  Coordinator  can  serve  as  a  proxy  for  the  Reporter,  and 
escalate  on  the  Reporter’s  behalf.  At  that  time,  the  Responsible  Disclosure 
process  starts  again. 
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Note:  In  situations  where  Tier  Two  investigations  have  not  resulted  in 
aetion,  the  Reporter  cannot  escalate  to  Tier  Three.  All  Tier  Three 
escalations  must  be  conducted  by  Coordinator. 


Responsible  Disclosure  of  Classified  Information: 

There  may  be  circumstances  that  arise  which  require  the  disclosure  of  classified 
information  in  DHS  Responsible  Disclosure  Process.  While  the  publically  accessible 
RDIS  can  only  be  used  for  the  submission  of  unclassified  information  (including 
Controlled  Unclassified  Information),  the  Responsible  Disclosure  Process  does  allow  for 
the  submission  of  classified  information. 

To  submit  a  report  on  organizational  wrongdoing  that  involves  classified 
information,  the  following  steps  are  recommended: 

1 .  Submit  a  report  on  the  RDIS  that  provides  an  overview  of  the  issue,  and 
check  the  “classified  submission”  box.  This  will  alert  NTP  that  a  classified 
submission  is  forthcoming.  In  the  overview,  do  not  include  any  classified 
information. 

Please  note:  in  order  to  maintain  anonymity,  this  information  MUST  be  submitted 
to  the  Coordinator.  Any  submissions  sent  directly  to  an  Investigator  will 
retain  personally  identifiable  information. 

2.  For  SECRET  information,  submit  supporting  documentation  through  the 
Homeland  Secure  Data  Network  (HSDN)  or  the  Secure  Internet  Protocol 
Router  Network  (SIPRNET).  Submissions  can  be  made  to  the  RDIS 
through  its  classified  site  at  http://NTP.SGOV.GOV/RDIS,  or  via  email  to 
RDIS@NTP.SGOV.GOV. 

3.  Eor  TOP  SECRET  information,  submit  supporting  documentation  through 
the  Joint  Worldwide  Intelligence  Communications  System  (JWICS). 
Submissions  can  be  made  through  http://NTP.IC.GOV/RDIS  or  via  email 
at  RDIS@NTP.IC.GOV. 

Submitting  information  via  a  government  computer  (as  is  required  with  classified 
information)  provides  the  opportunity  for  the  identity  of  Reporters  to  be  discovered 
through  computer  logs  and  monitoring.  Eor  additional  information  or  support  regarding 
the  submission  of  classified  information,  please  see  the  help  page  of  the  RDIS  or  call 
NTP  at  1-800-555-1000. 
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Protections  provided  through  the  DHS  Responsihle  Disclosure  Process: 

The  NTP  has  created  a  Virtual  Private  Network  (VPN),  through  which  Reporters 
can  securely  submit  information  either  to  the  Tier  One  Investigator  of  their  choice,  or 
directly  to  the  Coordinator  (NTP).  In  circumstances  where  the  submission  is  to  the 
Coordinator,  steps  will  be  taken  to  ensure  any  submission  has  been  stripped  of 
information,  which  could  serve  to  identify  the  Reporter,  prior  to  submission  to  an 
Investigator.  NTP  will  then  proceed  to  serve  as  a  proxy  for  the  Reporter,  escalating 
through  the  tiers  as  necessary  in  the  absence  of  Reporter  participation. 

This  process  provides  Reporters  (whistleblowers)  with  the  protections  afforded 
through  the  anonymous  submission  of  reports.  Additional  protections  can  be  provided  by 
using  the  Coordinator  to  serve  as  a  proxy  for  the  Reporter  (although  that  is  not  required  in 
the  Tier  One  or  Tier  Two).  Reporters  utilizing  the  Responsible  Disclosure  Process  who 
suffer  retaliations  or  reprisals  for  their  actions  are  protected  under  current  U.S.  law, 
specifically  the  First  Amendment  and  the  Whistleblower  Protection  Act.  In  those 
situations,  contact  the  Coordinator  immediately  to  receive  support  and  assistance.  Any 
Reporter  who  initiates  the  Responsible  Disclosure  process,  who  then  proceeds  to  full 
disclosure  without  the  consent/support  of  the  Coordinator,  forfeits  all  rights  to 
protections  and  anonymity. 

RDIS  is  based  on  an  apache-ssl  server  to  ensure  appropriate  end-to  end  encryption 
is  used  to  maintain  information  security.  The  public-key  fingerprint  for  the  submission 
site  is  available  on  the  DHS  Intranet,  and  can  be  used  to  authenticate  the  RDIS  certificate 
and  prevent  ‘ Man-in- the-middle’  attacks.  In  all  cases,  NTP  will  not  log  the  IP  address  of 
the  submitter.  If  possible,  do  not  use  DHS/Government  computers  to  submit  information 
to  the  RDIS  (except  in  cases  of  classified  disclosures),  as  this  severely  impacts  the 
anonymity  of  the  Report. 
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Reporters  should  praetiee  good  hygiene  with  regards  to  their  aetions  and 
submission,  ineluding  stripping  all  personally  identifiable  information  from  their 
submission,  running  malware/spyware  and  virus  seanners,  and  taking  preeautions  when 
using  teehnology  to  submit  information  (not  browsing  openly  while  they  browse 
anonymously)  to  prevent  overlap  and  java/eookie  exploits. 

More  information  regarding  the  risks  assoeiated  with  Responsible  Diselosure,  and 
the  steps  Reporters  ean  take  to  maximize  their  proteetions  is  available  on  the  RDIS 
information  page  at  www.whistleblowers.gov  or  www. responsibledisolosure.gov. 
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Figure  4.  Responsible  Disclosure  Process  Flow  Chart 
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V.  CONCLUSION 


A.  IMPLEMENTATION  ISSUES 

The  solutions  proposed  in  this  thesis  have  been  designed  in  a  way  that  allows  for 
immediate  implementation,  utilizing  currently  available  technology  and  carefully 
designed  business  processes  (data  rules)  to  provide  protection  to  whistleblowers  through 
anonymity.  A  limited  scope  pilot  program,  within  one  or  more  components  of  DHS, 
would  provide  an  excellent  opportunity  to  collect  data  on  employee  use  of  the  process 
and  to  identify  any  issues  prior  to  a  large-scale  investment  of  funds.  While  this  thesis 
makes  a  convincing  case  of  the  importance  of  whistleblowers  in  government,  a  number  of 
obstacles  still  stand  in  the  way  of  implementation.  For  any  realistic  possibility  of  the 
implementation  of  this  solution,  it  is  important  to  have  a  clear  understanding  of  the 
influential  factors  at  play. 

As  a  means  of  evaluating  future  utility  of  the  solutions  proposed  herein, 
awareness  of  how  the  environment  is  likely  to  change  in  the  near  future  must  exist.  Using 
a  scenario  based  planning  approach,  three  alternate  futures  capture  (most  of)  the  likely 
possibilities  at  a  high  level. 

•  Maintenance  of  the  status  quo 

•  Increased  protection  for  whistleblowers 

•  Decreased  protection  for  whistleblowers 

By  understanding  each  of  these  potential  future  states,  it  is  possible  to 
predict/evaluate  the  role  (usefulness)  that  the  proposed  solution  would  have  in  each  of  the 
alternate  futures.  However,  prior  to  the  review  of  each  scenario,  some  fundamentals  are 
true  regardless  of  the  future  environment. 

The  multi-disciplinary  approach  proposed  by  this  thesis  (the  third-party 
partnership  and  business  processes,  combined  with  the  innovative  use  of  technology)  is 
an  example  of  disruptive  innovation.  The  implementation  of  this  solution  would 
undermine  currently  established  policies  and  processes  for  whistleblowers.  Current 
legitimate/authorized  processes,  such  as  submission  through  standard  government 
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channels,  present  signifieant  risks  to  the  whistleblower.  Clandestine/unauthorized 
proeesses,  such  as  the  Internet  (Wikileaks)  and  mainstream  media,  represent  a  elear 
breaeh  of  the  law,  which  is  in  conflict  with  the  “do  the  right  thing”  mindset  of  many 
whistleblowers.  If  whistleblowers  had  a  way  to  communieate  identified  issues  through  an 
authorized  third  party  that  would  serve  as  a  proxy  on  their  behalf,  it  would  undermine  the 
eurrent  proeesses  (both  legitimate  and  clandestine),  potentially  making  them  obsolete.  It 
would  reduee  the  personal  risk  faced  by  whistleblowers  by  providing  the  anonymity  that 
makes  the  clandestine  approaeh  attraetive,  without  clearly  breaking  the  law.  If 
implemented  correetly,  the  number  of  legitimate  whistleblower  complaints  would 
increase  (overall  submissions  would  inerease),  and  the  number  of  whistleblowers  who 
choose  unauthorized  avenues  would  be  expected  to  deerease. 

Regardless  of  whieh  of  the  potential  scenarios  actually  plays  out  in  the  future, 

some  people/organizations  will  always  remain  that  firmly  rejeet  inereased  whistleblower 

protections.  The  primary  opponents  of  whistleblower  proteetions  (and  solutions  such  as 

those  presented  by  this  thesis)  will  continue  to  be  those  politicians,  government  officials, 

government  contractors  and  corporate  interests  that  attempt  to  maximize  profits  and/or 

increase  personal  gains  by  skirting  and/or  breaking  laws.  Unfortunately,  those  people  do 

not  identify  themselves  by  arguing  that  inereased  oversight  of/transparency  into  their 

aetivities  damages  their  ability  to  break  the  law.  Instead,  they  have  co-opted  a  legitimate 

coneern  regarding  the  need  for  government/corporate  seerecy,  and  maintain  an  inflexible 

position  on  it.  Secrecy  advocates,  those  who  believe  that  seerecy  for  government 

(national  seeurity)  or  eorporate  (proprietary  information)  purposes  trump  the  need  for 

transpareney,  would  also  likely  oppose  some  or  all  of  the  components  of  this  solution. 

Additionally,  transpareney  advocates,  those  who  fall  on  the  other  end  of  the  speetrum, 

may  also  oppose  this  solution  as  it  does  provide  for  a  measured/tiered  approach  (giving 

the  government  the  ability  to  address  any  issues/concerns  prior  to  broader  release  to  the 

public).  To  both  extremes,  seereey  and  transpareney,  this  solution  may  appear  as  a  either 

falling  short  (transparency)  or  going  too  far  (secrecy).  This  thesis  acknowledges  the  need 

for  secrecy,  as  well  as  transparency,  and  begins  by  speeifieally  identifying  the  need  for 

balance  between  the  two,  emphasizing  the  difficulty  in  weighing  whether  the  “benefits  of 

92 


disclosure  outweigh  the  eosts  of  disclosure”  (Stone,  2008).  Acknowledging  that  this  is  a 
wicked  problem,  to  which  there  may  be  no  clear  answer,  it  is  all  the  more  apparent  that  a 
balaneed  approach  is  critical. 

The  multidisciplinary  approach  has  been  used  in  this  solution  to  provide  the 
checks  and  balances  needed  to  maintain  a  balance  between  secrecy  and  transparency, 
without  exposing  whistleblowers  to  signifieant  retaliation  and  consequences.  Similar  to 
those  safeguards  established  through  the  ereation  of  the  three  U.S.  branches  of 
government,  creating  a  whistleblowing  process  that  relies  on  a  partnership  between  the 
government  and  an  outside  third  party  ensures  accountability,  moderation,  and  flexibility 
in  the  application  of  the  solution.  With  multiple  parties  and  unique  perspectives  involved 
in  the  process,  it  increases  the  likelihood  of  identifying  issues  and  creating  innovative 
solutions.  With  the  rapid  evolution  of  technology,  unforeseen  possibilities  and 
vulnerabilities,  and  the  ever-changing  political  environment,  rigid  adherence  to  a  single 
process  or  strueture  is  problematic.  Flexibility  and  adaptability  are  key  components, 
whieh  must  be  built  into  the  solution  for  it  to  be  successful.  The  spirit  of  the  solution, 
“faeilitating  the  reporting  of  wrongdoing  while  providing  protection  to  whistleblowers,” 
should  be  the  key  foeus  of  this  proeess.  The  details  surrounding  implementation  are 
peripheral  to  that  central  goal,  and  can  (and  should)  be  modified  as  the  environment 
changes. 

B,  ALTERNATE  FUTURES  FOR  THE  WHISTLEBLOWING 

ENVIRONMENT 

1.  Scenario  1:  Status  Quo 

•  Congress  continues  to  be  tom  on  the  role  of  whistleblowers  in  the 
government,  publically  supporting  whistleblowers,  however,  unable  to 
enaet  legislation  that  provides  meaningful  protections  to  government 
whistleblowers 

This  scenario  is  representative  of  the  status  quo,  and  reflects  the  eurrent 
atmosphere  for  both  public  perceptions  and  congressional  deeisions.  While 
whistleblowers  have  generally  been  viewed  favorably,  the  incident  surrounding  the 
unauthorized  disclosures  through  Wikileaks  has  created  an  association  of  whistleblowers 
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as  leakers/traitors,  which  is  evident  in  the  Obama  Administration’s  proseeution  of 
government  whistleblowers,  as  well  as  the  inability  of  Congress  to  pass  any  revised 
whistleblower  bills  (whether  inereasing  or  deereasing  protections). 

The  solution  proposed  by  this  thesis  fits  very  well  into  this  seenario,  and  eould  be 
implemented  as  a  bi-partisan,  balaneed  solution  to  the  problem.  It  would  fit  into  the 
agenda  for  seereey  advoeates  by  potentially  redueing  the  number  of  unauthorized 
diselosures  (to  Wikileaks,  Openleaks,  ete.),  while  creating  proeesses  to  improve  and 
inerease  transpareney  in  government  affairs,  a  clear  goal  of  transpareney  advoeates. 

2.  Scenario  2:  Increased  Protections  for  Whistleblowers 

•  Congress  ehanges  its  position  and  fully  supports  whistleblower 
proteetions,  enaeting  legislation  that  eneourages  whistleblowers  (through 
ineentives/protections),  clarifies  judicial  interpretations  of  the  law,  ereates 
a  user-friendly  proeess  for  submission  and  review,  and  imposes  severe 
penalties  in  eases  of  retaliation 

This  scenario  represents  a  signifieant  shift  in  the  mindset  of  the  U.S.  Government, 
whieh  has  historieally  erred  on  the  side  of  seereey  over  transpareney  (in  actions  if  not 
words).  If  the  U.S.  Government  were  to  take  a  definitively  pro-whistleblower  stanee, 
ineluding  earefully  worded  legislation  (to  overeome  judieial  interpretations),  signifieant 
alloeation  of  resourees  and  authorities  to  whistleblower  protection 
agencies/organizations,  and  zero-tolerance  for  retaliation  and  reprisals,  the 
whistleblowing  environment  may  radieally  ehange  over-time. 

In  this  seenario,  beeause  of  the  positive  aetions  of  the  U.S.  Government,  many  of 
the  eoneems  addressed  by  the  proposed  solution  would  vanish.  The  business  proeess  and 
its  assoeiated  teehnologieal  eomponents  would  still  be  useful  and  funetion  as  a  vehiele  to 
faeilitate  whistleblower  reporting;  however,  the  proteetions  provided  by  anonymity 
would  be  redundant. 

3,  Scenario  3:  Decreased  Protections  for  Whistleblowers 

•  Congress  ehanges  its  position  and  assoeiates  whistleblowers  with 
traitors/leakers,  eraeks  down  on  whistleblower  proteetions,  and 
eneourages  harsh  punishments  for  whistleblowing 
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This  scenario  builds  upon  the  negative  perceptions  generated  by  the  unauthorized 
disclosures  of  elassified  information,  the  assoeiation  of  whistleblowers  as  disloyal  (rats), 
and  the  prosecutions  of  whistleblowers  by  the  Obama  Administration.  The  result  is  that 
Congress  not  only  overturns  current  whistleblower  protections,  but  also  associates 
whistleblowing  with  traitors,  establishes  severe  punishments  for  whistleblowing  and 
strips  resources  away  from  agencies  responsible  to  investigate  claims  of  retaliation  and 
reprisal,  which  could  have  a  stifling  effect  on  the  whistleblowing  environment,  with  the 
number  of  authorized  whistleblowing  reports  decreasing  significantly. 

In  this  scenario,  because  of  the  overwhelmingly  negative  perception  of 
whistleblowing,  the  solution  proposed  by  this  thesis  is  unlikely  to  be  implemented  by  the 
U.S.  Government.  However,  it  does  seem  likely  (particularly  based  on  the  response  of  the 
Internet  to  legislation,  sueh  as  the  Stop  Online  Piraey  Act  (SOP A))  that  a  similar  solution 
would  be  developed  outside  of  the  government,  and  organizations,  such  as  Wikileaks 
would  likely  see  a  signifieant,  if  not  exponential,  increase  in  aetivity  on  their  site 
(Greenberg,  2011). 

Of  all  three  of  these  scenarios,  the  solution  proposed  by  this  thesis  is  best  suited  to 
address  the  current  whistleblowing  environment,  as  it  provides  a  balanced  approach  that 
can  appeal  to  both  seerecy  and  transpareney  advoeates.  If  a  shift  occurs  to  either  of  the 
two  extremes,  the  rationale  for  and/or  likelihood  of  implementation  decreases 
significantly.  With  the  understanding  that  the  political  winds  can  shift  rapidly  in  either 
direction,  any  of  these  scenarios  is  possible.  If  a  near-term  implementation  of  the 
proposed  solution  occurs,  it  can  be  adapted  or  modified  as  needed  for  future  scenarios,  at 
little  eost. 

If  implemented,  regardless  of  the  future  environment,  this  solution  will  most 
likely  result  in  one  of  the  following  outcomes. 

•  Increased  authorized  whistleblowing,  and  deereased  unauthorized 
whistleblowing 

•  Increased  authorized  whistleblowing,  and  no  effect  on  unauthorized 
whistleblowing 
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•  No  effect  on  authorized  whistleblowing,  and  decreased  unauthorized 
whistleblowing 

•  No  effect  on  the  whistleblowing  environment  (authorized  or  unauthorized) 

It  is  possible,  albeit  unlikely,  that  one  of  the  following  outcomes  could  occur. 

•  Increased  authorized  whistleblowing,  and  increased  unauthorized 
whistleblowing 

•  Decreased  authorized  whistleblowing,  and  increased  unauthorized 
whistleblowing 

•  No  effect  on  authorized  whistleblowing,  and  increased  unauthorized 
whistleblowing 

The  top  three  likely  outcomes  all  reflect  positive  changes  in  the  whistleblowing 
environment,  with  the  fourth  likely  possibility  reflecting  no  change  at  all.  Logically,  the 
three  bottom  outcomes  are  unlikely  to  occur  based  from  the  implementation  of  this 
solution  (they  are  more  likely  to  result  from  other  factors  affecting  the  environment).  The 
risks  associated  with  implementing  this  solution,  to  include  cost  and  the  sharing  of 
responsibility  for  secrecy/transparency  with  a  third  party  are  manageable,  and  potentially, 
offset  through  funding  recovered  from  fraud/waste  cases,  and  through  appropriate 
administration/investigation  of  whistleblower  reports. 

C.  FUTURE  RESEARCH 

A  few  areas  of  future  research  should  be  explored  prior  to  the  development  and 
implementation  of  the  recommendations  in  this  thesis. 

•  Evaluation  of  third-party  organizations — To  provide  for  the  maximum 
possibility  of  success,  an  appropriate  third  party  must  be  identified.  Only 
an  organization  that  meets  the  criteria  identified  above  will  be  able  to 
provide  the  credibility  required  to  increase  public  trust  in  the  process.  If 
the  process  is  not  trusted,  it  will  fail. 

•  Identification  of  appropriate  investigators — Currently,  multiple 
avenues  exist  that  whistleblowers  can  use  to  submit  reports,  including  the 
IG,  the  GAO,  and  the  OSC.  Clear  roles  and  responsibilities  need  to  be 
established  that  identify  appropriate  tier  one  and  tier  two  investigators,  and 
ensure  that  the  investigation  process  itself  meets  or  exceeds  required 
standards. 
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•  Analyze  and  determine  appropriate  funding  levels — Many  of  the 
problems  facing  government  agencies  with  the  responsibility  for 
investigation  stem  from  the  lack  of  appropriate  funding  and  staffing  levels, 
which  leads  to  unacceptable  delays  and  backlogs  of  investigations, 
contributing  to  unauthorized  disclosures.  Any  investigators  must  have  the 
funding  and  staffing  levels  commiserate  with  the  quantity  of  reports 
submitted.  To  reduce  stovepiping  and  backlogs  in  individual 
organizations,  perhaps  partnerships  could  be  formed  within  tier  one  and 
tier  two  investigators  to  distribute  the  workload  evenly  and  reduce  the 
probability  of  backlogs. 

•  Develop  metrics  for  post-implementation  evaluation — While  multiple 
potential  outcomes  have  been  identified,  the  only  way  to  determine 
success  will  be  through  the  development  of  clear  metrics,  which  can  be 
used  to  evaluate  the  process,  identify  its  impact  on  the  whistleblowing 
environment,  and  prompt  changes  as  needed  to  support  the  realization  of 
success. 

While  this  thesis  has  presented  a  solution  based  on  a  realistic  need,  clearly 
identified  benefits,  and  few  risks,  it  is  important  to  understand  one  last  fundamental 
element  required  for  this  solution  to  be  realistically  implemented.  Regardless  of  the 
environment,  this  solution  requires  a  champion  within  the  government  who  has  the 
vision,  authority  and  resources  to  make  this  happen.  This  solution  cannot  be  driven  from 
the  program  manager  level  of  government;  it  must  stem  from  leadership  and  contain  the 
authorities  and  resources  necessary  for  implementation  (initially  for  a  pilot  program,  and 
ultimately,  broader  implementation  and  sustainment).  However,  by  creating  an  authorized 
process  through  which  homeland  security  employees  can  submit  whistleblowing 
information  without  fear  of  reprisals,  it  may  increase  the  likelihood  of  whistleblower 
reporting  in  the  first  place,  and  reduce  the  number  of  leaks  to  unauthorized  recipients, 
which  would  function  as  a  check  and  balance  system,  helping  to  bypass  administrative 
roadblocks  and  providing  a  mechanism  through  which  homeland  security  can  monitor 
and  increase  efficiency  in  its  operations. 

Despite  the  efforts  of  the  U.S.  Government  and  its  allies,  including  private  sector 
interests  and  powerful  corporations,  Wikileaks  continues  to  demonstrate  relevance  and 
operational  functionality,  most  recently  through  the  release  of  over  four  million  emails 
from  the  private  security  company  “Stratfor”  (Kelly,  2012).  While  these  emails  do  not 
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represent  whistleblowing  (they  were  haeked  by  representatives  of  the  Internet 
organization  Anonymous),  they  do  serve  to  demonstrate  further  the  value  of  the 
proteetion  and  distribution  methods  provided  through  the  ‘Wikileaks  model.’  Reva 
Bhalla,  the  Direetor  of  Analysis  for  Stratfor  reeently  stated,  “Wikileaks  itself  may 
struggle  to  survive  but  the  idea  that’s  put  out  here,  that  anyone  with  the  bandwidth  and 
servers  to  support  sueh  a  system  can  act  as  a  prime  outlet  of  leaks.  [People]  are  obsessed 
with  this  kind  of  stuff  The  idea  behind  it  won’t  die”  (Dorling,  2012).  The  DHS  has  an 
opportunity  to  build  upon  and  improve  the  “Wikileaks  Model,”  to  harness  its  use  of 
technology  and  process  to  create  a  solution  that  would  meet  the  needs  of  both 
whistleblowers  and  the  government. 

The  world  is  constantly  changing,  secrets  are  becoming  harder  to  maintain  and 
democracy  is  happening  in  real  time  via  the  Internet  around  the  world.  The  current 
mentality  around  whistleblower  protection  is  inadequate,  and  inaction  on  this  front  will 
result  in  decreasing  instances  of  authorized  whistleblowing  and  increased  unauthorized 
whistleblowing.  It  is  brave  people  who  do  the  right  thing,  regardless  of  personal  cost.  It  is 
our  duty  as  government  officials  to  protect  them,  and  to  encourage  accountability, 
transparency,  and  ethics  in  government  operations.  It  is  time  to  adapt  our  mindset  and 
catch  up  to  the  world  around  us. 

The  world  we  have  created  is  a  product  of  our  thinking... it  cannot  be 
changed  without  changing  our  thinking. 

-  Albert  Einstein 
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APPENDIX.  RESPONSIBLE  DISCLOSURE  INFORMATION 
SYSTEM  (RDIS)  MOCK-UPS 

The  Responsible  Disclosure  Information  System  would  serve  as  the  front-end 
interface  for  whistleblowers  to  access  the  DHS’s  responsible  disclosure  process.  The 
RDIS  would  allow  whistleblowers  to  submit  reports,  receive  notifications,  provide 
updates,  and  request  escalation,  all  with  relative  anonymity.  The  following  nine  screen 
shots  serve  as  an  example  of  what  the  RDIS  might  look  like,  and  allow  for  a  little  more 
in-depth  view  of  the  system  itself 
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Welcome  Page 


This  introductory  page  would  serve  as  the  main  page  for  the  RDIS.  On  the  right 
would  be  a  welcome/baekground  video  given  by  a  senior  DHS  official,  reinforcing  the 
legitimacy  and  importance  of  this  proeess,  and  the  role  of  whistleblowers  in  government. 

From  this  page,  users  would  be  able  to  follow  links  to; 

•  General/baekground  information 

•  Submit  a  report 

•  Lookup  a  case  (previously  submitted  report) 
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General  Information 


http://www  whistleblower  gov 

<:3i±>  x<^i 


]  CZD 


Heb  I  Aboot 


Home  >  Report  Issue  >  Generol  Information 


Whot  you  shoUd  know  before 

Reporting  Fraud,  Waste,  and  Abuse 

A  porogroph  of  text  A  porogroph  of  text  A  porogroph  of  text  A  paragraph  of 
text  A  paragraph  of  text  A  paragraph  of  text  A  paragraph  of  text  A 
porogroph  of  text  A  paragraph  of  text  A  porogroph  of  text  A  paragraph  of 
text  A  paragraph  of  text  A  paragraph  of  text  A  paragraph  of  text  A 
paragraph  of  text  A  paragraph  of  text  A  paragraph  of  text  A  paragraph  of 
text  A  paragraph  of  text  A  porogroph  of  text  A  paragraph  of  text  A 
porogroph  of  text  A  paragraph  of  text  A  paragraph  of  text  A  paragraph  of 
text  A  paragraph  of  text  A  paragraph  of  text  A  paragraph  of  text  A 


O' 


Report  on  Issue 


how  we  protect  votr  identity 

Exomdee  of  froud/woste/obose 

Report  on  issue 


This  general/background  information  page  would  serve  to  provide  users 
additional  details  to  help  users  make  informed  deeisions.  This  page  is  designed  to  assist 
employees  who  have  already  deeided  to  beeome  whistleblowers,  those  who  are 
considering  their  options,  as  well  as  to  educate  other  employees  on  the  appropriate 
process.  This  page  provides  information  on  the  following. 

•  The  definition  of  organizational  wrongdoing  and  examples 

•  A  detailed  explanation  of  the  Responsible  Disclosure  Process 

•  Details  on  the  protections  offered  by  the  RDIS  and  the  limitations 
associated  with  the  process 

•  Recommendations  for  practicing  ‘good  hygiene’  as  whistleblowers 
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Report  an  Issue:  Event  Deseription 


This  page  is  the  first  page  of  the  submission  process.  The  whistleblower  would 
provide  the  initial  report  on  the  issue,  identifying  the  agency,  suspected  wrongdoing,  and 
additional  pertinent  information. 
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Report  an  Issue:  Event  Deseription 


This  page  is  the  second  page  of  the  submission  process.  The  whistleblower  could 
submit  the  names  of  individuals;  either  those  directly  involved  or  people  who  may  be 
able  to  provide  additional  information  during  the  investigation. 
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Report  an  Issue:  Review  and  Submissions 


This  is  the  final  page  of  the  submission  proeess.  The  whistleblower  would  review 
the  information  to  ensure  aeeuraey  prior  to  submission  and  also  ereate  a  ‘personal 
passphrase’  to  allow  to  aeeess  case  files  on  the  RDIS  in  the  future. 
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Case  Confirmation 


This  page  is  the  confirmation  page  for  submission  of  the  whistleblower’s  report.  It 
is  important  for  whistleblowers  to  record  the  information  here,  as  all  three  items  (case 
number,  submission  date,  and  personal  phrase)  are  required  to  access  case  files  in  the 
future. 
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Case  Lookup:  General  Information 


Upon  completion  of  the  submission  process,  RDIS  users  would  be  directed  to  this 
case  lookup  information  page,  which  would  provide  additional  information  about  the 
process,  speeifically  the  investigation  timelines,  roles  and  responsibilities,  and  personal 
protections  of  which  whistleblowers  should  be  aware.  Whistleblowers  are  also  informed 
of  when  they  should  check  into  the  RDIS  for  updated  information,  and  the  possible 
actions  they  can  take  in  the  future. 
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Case  Lookup:  Request 


At  defined  intervals  during  the  Responsible  Diselosure  proeess,  the  RDIS  will  be 
updated  with  information  on  the  status  of  the  ease.  Through  this  page,  whistleblowers  ean 
aeeess  the  ease  status/message  page  by  providing  the  ease  number,  submission  date,  and 
personal  phrase  generated  upon  their  initial  submission. 
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Case  Lookup:  Case  Details 


This  case  lookup  page  will  provide  the  whistleblower  information  on  the  eurrent 
status  of  their  ease.  It  also  ineludes  a  messaging  function,  a  vehicle  through  which 
investigators/coordinators  can  request  or  receive  information  from  whistleblowers  (who 
retain  anonymity). 
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